@vohongtho.infotech/code-intel 0.7.0 → 0.8.0

package/dist/cli/main.js

@@ -7,8 +7,8 @@ import { SEMRESATTRS_DEPLOYMENT_ENVIRONMENT, SEMRESATTRS_SERVICE_NAME } from '@o
 import { SpanStatusCode, trace, context } from '@opentelemetry/api';
 import winston from 'winston';
 import DailyRotateFile from 'winston-daily-rotate-file';
-import fs33, { readFileSync, existsSync } from 'fs';
-import path33, { dirname, join } from 'path';
+import fs34, { readFileSync, existsSync } from 'fs';
+import path35, { dirname, join } from 'path';
 import os12 from 'os';
 import { Registry, collectDefaultMetrics, Counter, Histogram, Gauge } from 'prom-client';
 import { createRequire } from 'module';
@@ -326,7 +326,7 @@ var init_logger = __esm({
         };
       }
       /** Global log directory: ~/.code-intel/logs */
-      static LOG_DIR = path33.join(os12.homedir(), ".code-intel", "logs");
+      static LOG_DIR = path35.join(os12.homedir(), ".code-intel", "logs");
       static getLogger() {
         if (!_Logger.instance) {
           const isProduction = process.env.NODE_ENV === "production";
@@ -335,12 +335,12 @@ var init_logger = __esm({
           transports.push(new winston.transports.Console());
           if (!isProduction) {
             try {
-              if (!fs33.existsSync(_Logger.LOG_DIR)) {
-                fs33.mkdirSync(_Logger.LOG_DIR, { recursive: true });
+              if (!fs34.existsSync(_Logger.LOG_DIR)) {
+                fs34.mkdirSync(_Logger.LOG_DIR, { recursive: true });
               }
               transports.push(
                 new DailyRotateFile({
-                  filename: path33.join(_Logger.LOG_DIR, "%DATE%-code-intel.log"),
+                  filename: path35.join(_Logger.LOG_DIR, "%DATE%-code-intel.log"),
                   datePattern: "YYYY-MM-DD",
                   maxSize: "20m",
                   maxFiles: "14d"
@@ -540,25 +540,25 @@ function validateDAG(phases) {
   const visiting = /* @__PURE__ */ new Set();
   const visited = /* @__PURE__ */ new Set();
   const phaseMap = new Map(phases.map((p) => [p.name, p]));
-  function dfs(name, path34) {
+  function dfs(name, path36) {
     if (visiting.has(name)) {
-      const cycleStart = path34.indexOf(name);
-      const cycle = path34.slice(cycleStart).concat(name);
+      const cycleStart = path36.indexOf(name);
+      const cycle = path36.slice(cycleStart).concat(name);
       errors.push({ type: "cycle", message: `Cycle detected: ${cycle.join(" \u2192 ")}` });
       return true;
     }
     if (visited.has(name)) return false;
     visiting.add(name);
-    path34.push(name);
+    path36.push(name);
     const phase = phaseMap.get(name);
     if (phase) {
       for (const dep of phase.dependencies) {
-        if (dfs(dep, path34)) return true;
+        if (dfs(dep, path36)) return true;
       }
     }
     visiting.delete(name);
     visited.add(name);
-    path34.pop();
+    path36.pop();
     return false;
   }
   for (const phase of phases) {
@@ -818,11 +818,11 @@ var init_id_generator = __esm({
   }
 });
 function findBundledWasmDir() {
-  const fileDir = path33.dirname(fileURLToPath(import.meta.url));
+  const fileDir = path35.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path33.join(fileDir, "wasm"),
+    path35.join(fileDir, "wasm"),
     // dist/index.js → dist/wasm/
-    path33.join(fileDir, "../wasm")
+    path35.join(fileDir, "../wasm")
     // dist/cli/main.js → dist/wasm/
   ];
   for (const candidate of candidates) {
@@ -863,7 +863,7 @@ function wasmPath(lang) {
   }
   const bundled = BUNDLED_WASM_MAP[lang];
   if (bundled) {
-    const bundledPath = path33.join(_bundledWasmDir, bundled);
+    const bundledPath = path35.join(_bundledWasmDir, bundled);
     if (existsSync(bundledPath)) return bundledPath;
   }
   return null;
@@ -876,14 +876,14 @@ async function initParser() {
 }
 async function getLanguage(lang) {
   if (languageCache.has(lang)) return languageCache.get(lang);
-  const path34 = wasmPath(lang);
-  if (!path34) {
+  const path36 = wasmPath(lang);
+  if (!path36) {
     languageCache.set(lang, null);
     return null;
   }
   try {
     await initParser();
-    const language = await Language.load(path34);
+    const language = await Language.load(path36);
     languageCache.set(lang, language);
     return language;
   } catch {
@@ -2308,7 +2308,7 @@ var init_parse_phase = __esm({
           const batch = filePaths.slice(i, i + CONCURRENCY);
           await Promise.all(batch.map(async (filePath) => {
             try {
-              const source = await fs33.promises.readFile(filePath, "utf-8");
+              const source = await fs34.promises.readFile(filePath, "utf-8");
               context2.fileCache.set(filePath, source);
             } catch {
             }
@@ -2321,14 +2321,14 @@ var init_parse_phase = __esm({
           const lang = detectLanguage(filePath);
           if (!lang) {
             if (context2.verbose) {
-              const relativePath2 = path33.relative(context2.workspaceRoot, filePath);
+              const relativePath2 = path35.relative(context2.workspaceRoot, filePath);
               logger_default.info(`  [parse] skipped (no parser): ${relativePath2}`);
             }
             continue;
           }
           const source = context2.fileCache.get(filePath);
           if (!source) continue;
-          const relativePath = path33.relative(context2.workspaceRoot, filePath);
+          const relativePath = path35.relative(context2.workspaceRoot, filePath);
           const fileNodeId = generateNodeId("file", relativePath, relativePath);
           const fileNode = context2.graph.getNode(fileNodeId);
           if (fileNode) {
@@ -2574,11 +2574,11 @@ var init_resolve_phase = __esm({
         let heritageEdges = 0;
         const fileIndex = /* @__PURE__ */ new Map();
         for (const fp of filePaths) {
-          const rel = path33.relative(workspaceRoot, fp);
+          const rel = path35.relative(workspaceRoot, fp);
           fileIndex.set(rel, fp);
           const noExt = rel.replace(/\.\w+$/, "");
           if (!fileIndex.has(noExt)) fileIndex.set(noExt, fp);
-          const base = path33.basename(rel, path33.extname(rel));
+          const base = path35.basename(rel, path35.extname(rel));
           if (!fileIndex.has(base)) fileIndex.set(base, fp);
         }
         const symbolIndex = /* @__PURE__ */ new Map();
@@ -2609,7 +2609,7 @@ var init_resolve_phase = __esm({
         for (const filePath of filePaths) {
           const lang = detectLanguage(filePath);
           if (!lang) continue;
-          const relativePath = path33.relative(workspaceRoot, filePath);
+          const relativePath = path35.relative(workspaceRoot, filePath);
           const fileNodeId = generateNodeId("file", relativePath, relativePath);
           const source = fileCache.get(filePath);
           if (!source) continue;
@@ -2622,13 +2622,13 @@ var init_resolve_phase = __esm({
             let resolvedRelPath = null;
             if (cleaned.startsWith(".")) {
               const cleanedNoJs = cleaned.replace(/\.(js|jsx)$/, "");
-              const fromDir = path33.dirname(relativePath);
+              const fromDir = path35.dirname(relativePath);
               for (const ext of ["", ".ts", ".tsx", ".js", ".jsx", ".py", ".java", ".go", "/index.ts", "/index.js"]) {
-                const candidate = path33.join(fromDir, cleanedNoJs + ext);
-                const normalized = path33.normalize(candidate);
+                const candidate = path35.join(fromDir, cleanedNoJs + ext);
+                const normalized = path35.normalize(candidate);
                 if (fileIndex.has(normalized)) {
                   const absPath = fileIndex.get(normalized);
-                  resolvedRelPath = path33.relative(workspaceRoot, absPath);
+                  resolvedRelPath = path35.relative(workspaceRoot, absPath);
                   break;
                 }
               }
@@ -3093,7 +3093,7 @@ var init_db_manager = __esm({
         this.dbPath = dbPath;
       }
       async init() {
-        fs33.mkdirSync(path33.dirname(this.dbPath), { recursive: true });
+        fs34.mkdirSync(path35.dirname(this.dbPath), { recursive: true });
         this.db = new Database$1(this.dbPath);
         await this.db.init();
         this.conn = new Connection(this.db);
@@ -3190,7 +3190,7 @@ var init_schema = __esm({
   }
 });
 function writeNodeCSVs(graph, outputDir) {
-  fs33.mkdirSync(outputDir, { recursive: true });
+  fs34.mkdirSync(outputDir, { recursive: true });
   const header = "id,name,file_path,start_line,end_line,exported,content,metadata\n";
   const tableBuffers = /* @__PURE__ */ new Map();
   const tableFilePaths = /* @__PURE__ */ new Map();
@@ -3198,7 +3198,7 @@ function writeNodeCSVs(graph, outputDir) {
     const table = NODE_TABLE_MAP[node.kind];
     if (!tableBuffers.has(table)) {
       tableBuffers.set(table, [header]);
-      tableFilePaths.set(table, path33.join(outputDir, `${table}.csv`));
+      tableFilePaths.set(table, path35.join(outputDir, `${table}.csv`));
     }
     tableBuffers.get(table).push(
       csvRow([
@@ -3218,12 +3218,12 @@ function writeNodeCSVs(graph, outputDir) {
     );
   }
   for (const [table, lines] of tableBuffers) {
-    fs33.writeFileSync(tableFilePaths.get(table), lines.join(""), "utf-8");
+    fs34.writeFileSync(tableFilePaths.get(table), lines.join(""), "utf-8");
   }
   return tableFilePaths;
 }
 function writeEdgeCSV(graph, outputDir) {
-  fs33.mkdirSync(outputDir, { recursive: true });
+  fs34.mkdirSync(outputDir, { recursive: true });
   const header = "from_id,to_id,kind,weight,label\n";
   const groups = /* @__PURE__ */ new Map();
   for (const edge of graph.allEdges()) {
@@ -3234,7 +3234,7 @@ function writeEdgeCSV(graph, outputDir) {
     const toTable = NODE_TABLE_MAP[targetNode.kind];
     const key = `${fromTable}->${toTable}`;
     if (!groups.has(key)) {
-      const filePath = path33.join(outputDir, `edges_${fromTable}_${toTable}.csv`);
+      const filePath = path35.join(outputDir, `edges_${fromTable}_${toTable}.csv`);
       groups.set(key, { lines: [header], from: fromTable, to: toTable, filePath });
     }
     groups.get(key).lines.push(
@@ -3249,7 +3249,7 @@ function writeEdgeCSV(graph, outputDir) {
   }
   const result = [];
   for (const group of groups.values()) {
-    fs33.writeFileSync(group.filePath, group.lines.join(""), "utf-8");
+    fs34.writeFileSync(group.filePath, group.lines.join(""), "utf-8");
     result.push({ fromTable: group.from, toTable: group.to, filePath: group.filePath });
   }
   return result;
@@ -3292,7 +3292,7 @@ async function loadGraphToDB(graph, dbManager) {
     } catch {
     }
   }
-  const tmpDir = fs33.mkdtempSync(path33.join(os12.tmpdir(), "code-intel-csv-"));
+  const tmpDir = fs34.mkdtempSync(path35.join(os12.tmpdir(), "code-intel-csv-"));
   try {
     const nodeTableFiles = writeNodeCSVs(graph, tmpDir);
     const edgeGroups = writeEdgeCSV(graph, tmpDir);
@@ -3311,8 +3311,8 @@ async function loadGraphToDB(graph, dbManager) {
     }
     let nodeCount = 0;
     for (const [table, csvPath] of nodeTableFiles) {
-      if (!fs33.existsSync(csvPath)) continue;
-      const stat = fs33.statSync(csvPath);
+      if (!fs34.existsSync(csvPath)) continue;
+      const stat = fs34.statSync(csvPath);
       if (stat.size < 50) continue;
       try {
         await dbManager.execute(
@@ -3325,8 +3325,8 @@ async function loadGraphToDB(graph, dbManager) {
     }
     let edgeCount = 0;
     for (const group of edgeGroups) {
-      if (!fs33.existsSync(group.filePath)) continue;
-      const stat = fs33.statSync(group.filePath);
+      if (!fs34.existsSync(group.filePath)) continue;
+      const stat = fs34.statSync(group.filePath);
       if (stat.size < 50) continue;
       try {
         await dbManager.execute(
@@ -3340,7 +3340,7 @@ async function loadGraphToDB(graph, dbManager) {
     return { nodeCount, edgeCount };
   } finally {
     try {
-      fs33.rmSync(tmpDir, { recursive: true, force: true });
+      fs34.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -3442,15 +3442,15 @@ var init_graph_loader = __esm({
 });
 function loadRegistry() {
   try {
-    const data = fs33.readFileSync(REPOS_FILE, "utf-8");
+    const data = fs34.readFileSync(REPOS_FILE, "utf-8");
     return JSON.parse(data);
   } catch {
     return [];
   }
 }
 function saveRegistry(entries) {
-  fs33.mkdirSync(GLOBAL_DIR, { recursive: true });
-  fs33.writeFileSync(REPOS_FILE, JSON.stringify(entries, null, 2));
+  fs34.mkdirSync(GLOBAL_DIR, { recursive: true });
+  fs34.writeFileSync(REPOS_FILE, JSON.stringify(entries, null, 2));
 }
 function upsertRepo(entry) {
   const entries = loadRegistry();
@@ -3469,28 +3469,28 @@ function removeRepo(repoPath) {
 var GLOBAL_DIR, REPOS_FILE;
 var init_repo_registry = __esm({
   "src/storage/repo-registry.ts"() {
-    GLOBAL_DIR = path33.join(os12.homedir(), ".code-intel");
-    REPOS_FILE = path33.join(GLOBAL_DIR, "repos.json");
+    GLOBAL_DIR = path35.join(os12.homedir(), ".code-intel");
+    REPOS_FILE = path35.join(GLOBAL_DIR, "repos.json");
   }
 });
 function saveMetadata(repoDir, metadata) {
-  const metaDir = path33.join(repoDir, ".code-intel");
-  fs33.mkdirSync(metaDir, { recursive: true });
-  fs33.writeFileSync(path33.join(metaDir, "meta.json"), JSON.stringify(metadata, null, 2));
+  const metaDir = path35.join(repoDir, ".code-intel");
+  fs34.mkdirSync(metaDir, { recursive: true });
+  fs34.writeFileSync(path35.join(metaDir, "meta.json"), JSON.stringify(metadata, null, 2));
 }
 function loadMetadata(repoDir) {
   try {
-    const data = fs33.readFileSync(path33.join(repoDir, ".code-intel", "meta.json"), "utf-8");
+    const data = fs34.readFileSync(path35.join(repoDir, ".code-intel", "meta.json"), "utf-8");
     return JSON.parse(data);
   } catch {
     return null;
   }
 }
 function getDbPath(repoDir) {
-  return path33.join(repoDir, ".code-intel", "graph.db");
+  return path35.join(repoDir, ".code-intel", "graph.db");
 }
 function getVectorDbPath(repoDir) {
-  return path33.join(repoDir, ".code-intel", "vector.db");
+  return path35.join(repoDir, ".code-intel", "vector.db");
 }
 var init_metadata = __esm({
   "src/storage/metadata.ts"() {
@@ -3546,27 +3546,27 @@ __export(group_registry_exports, {
   saveSyncResult: () => saveSyncResult
 });
 function groupFile(name) {
-  return path33.join(GROUPS_DIR, `${name}.json`);
+  return path35.join(GROUPS_DIR, `${name}.json`);
 }
 function loadGroup(name) {
   try {
-    return JSON.parse(fs33.readFileSync(groupFile(name), "utf-8"));
+    return JSON.parse(fs34.readFileSync(groupFile(name), "utf-8"));
   } catch {
     return null;
   }
 }
 function saveGroup(group) {
-  fs33.mkdirSync(GROUPS_DIR, { recursive: true });
-  fs33.writeFileSync(groupFile(group.name), JSON.stringify(group, null, 2) + "\n");
+  fs34.mkdirSync(GROUPS_DIR, { recursive: true });
+  fs34.writeFileSync(groupFile(group.name), JSON.stringify(group, null, 2) + "\n");
 }
 function listGroups() {
   const groups = [];
   try {
-    for (const file of fs33.readdirSync(GROUPS_DIR)) {
+    for (const file of fs34.readdirSync(GROUPS_DIR)) {
       if (!file.endsWith(".json") || file.endsWith(".sync.json")) continue;
       try {
         const g = JSON.parse(
-          fs33.readFileSync(path33.join(GROUPS_DIR, file), "utf-8")
+          fs34.readFileSync(path35.join(GROUPS_DIR, file), "utf-8")
         );
         groups.push(g);
       } catch {
@@ -3578,16 +3578,16 @@ function listGroups() {
 }
 function deleteGroup(name) {
   try {
-    fs33.unlinkSync(groupFile(name));
+    fs34.unlinkSync(groupFile(name));
   } catch {
   }
   try {
-    fs33.unlinkSync(path33.join(GROUPS_DIR, `${name}.sync.json`));
+    fs34.unlinkSync(path35.join(GROUPS_DIR, `${name}.sync.json`));
   } catch {
   }
 }
 function groupExists(name) {
-  return fs33.existsSync(groupFile(name));
+  return fs34.existsSync(groupFile(name));
 }
 function addMember(groupName, member) {
   const group = loadGroup(groupName);
@@ -3613,16 +3613,16 @@ function removeMember(groupName, groupPath) {
   return group;
 }
 function saveSyncResult(result) {
-  fs33.mkdirSync(GROUPS_DIR, { recursive: true });
-  fs33.writeFileSync(
-    path33.join(GROUPS_DIR, `${result.groupName}.sync.json`),
+  fs34.mkdirSync(GROUPS_DIR, { recursive: true });
+  fs34.writeFileSync(
+    path35.join(GROUPS_DIR, `${result.groupName}.sync.json`),
     JSON.stringify(result, null, 2) + "\n"
   );
 }
 function loadSyncResult(groupName) {
   try {
     return JSON.parse(
-      fs33.readFileSync(path33.join(GROUPS_DIR, `${groupName}.sync.json`), "utf-8")
+      fs34.readFileSync(path35.join(GROUPS_DIR, `${groupName}.sync.json`), "utf-8")
     );
   } catch {
     return null;
@@ -3631,7 +3631,7 @@ function loadSyncResult(groupName) {
 var GROUPS_DIR;
 var init_group_registry = __esm({
   "src/multi-repo/group-registry.ts"() {
-    GROUPS_DIR = path33.join(os12.homedir(), ".code-intel", "groups");
+    GROUPS_DIR = path35.join(os12.homedir(), ".code-intel", "groups");
   }
 });
 
@@ -3716,12 +3716,12 @@ function scanForFiles(root, matcher, maxDepth = 2) {
     if (depth > maxDepth) return;
     let entries;
     try {
-      entries = fs33.readdirSync(dir, { withFileTypes: true });
+      entries = fs34.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const full = path33.join(dir, entry.name);
+      const full = path35.join(dir, entry.name);
       if (entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules") {
         walk2(full, depth + 1);
       } else if (entry.isFile() && matcher(entry.name)) {
@@ -3737,8 +3737,8 @@ var init_file_scanner = __esm({
   }
 });
 function tryParseFile(filePath) {
-  const ext = path33.extname(filePath).toLowerCase();
-  const content = fs33.readFileSync(filePath, "utf-8");
+  const ext = path35.extname(filePath).toLowerCase();
+  const content = fs34.readFileSync(filePath, "utf-8");
   if (ext === ".json") {
     try {
       return JSON.parse(content);
@@ -3807,7 +3807,7 @@ async function parseGraphQLContracts(repoRoot) {
   const files = scanForFiles(repoRoot, (name) => name.endsWith(".graphql") || name.endsWith(".gql"));
   const contracts = [];
   for (const filePath of files) {
-    const content = fs33.readFileSync(filePath, "utf-8");
+    const content = fs34.readFileSync(filePath, "utf-8");
     const typeRegex = /type\s+(\w+)\s*\{([^}]+)\}/g;
     let match;
     while ((match = typeRegex.exec(content)) !== null) {
@@ -3843,7 +3843,7 @@ async function parseProtoContracts(repoRoot) {
   const files = scanForFiles(repoRoot, (name) => name.endsWith(".proto"));
   const contracts = [];
   for (const filePath of files) {
-    const content = fs33.readFileSync(filePath, "utf-8");
+    const content = fs34.readFileSync(filePath, "utf-8");
     const serviceRegex = /service\s+(\w+)\s*\{([^}]+)\}/g;
     let serviceMatch;
     while ((serviceMatch = serviceRegex.exec(content)) !== null) {
@@ -4061,8 +4061,8 @@ async function syncGroup(group) {
       logger_default.warn(`  \u26A0 Registry entry "${member.registryName}" not found \u2014 skipping ${member.groupPath}`);
       continue;
     }
-    const dbPath = path33.join(regEntry.path, ".code-intel", "graph.db");
-    if (!fs33.existsSync(dbPath)) {
+    const dbPath = path35.join(regEntry.path, ".code-intel", "graph.db");
+    if (!fs34.existsSync(dbPath)) {
       logger_default.warn(`  \u26A0 No index at ${dbPath} \u2014 run \`code-intel analyze ${regEntry.path}\` first`);
       continue;
     }
@@ -4175,10 +4175,10 @@ var init_codes = __esm({
   }
 });
 function secureMkdir(dir) {
-  fs33.mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  fs34.mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
   if (process.platform !== "win32") {
     try {
-      fs33.chmodSync(dir, SECURE_DIR_MODE);
+      fs34.chmodSync(dir, SECURE_DIR_MODE);
     } catch {
     }
   }
@@ -4186,22 +4186,22 @@ function secureMkdir(dir) {
 function secureChmodFile(file) {
   if (process.platform === "win32") return;
   try {
-    fs33.chmodSync(file, SECURE_FILE_MODE);
+    fs34.chmodSync(file, SECURE_FILE_MODE);
   } catch {
   }
 }
 function secureWriteFile(file, data) {
-  secureMkdir(path33.dirname(file));
-  fs33.writeFileSync(file, data, { mode: SECURE_FILE_MODE });
+  secureMkdir(path35.dirname(file));
+  fs34.writeFileSync(file, data, { mode: SECURE_FILE_MODE });
   secureChmodFile(file);
 }
 function tightenDbFiles(dir) {
   if (process.platform === "win32") return;
-  if (!fs33.existsSync(dir)) return;
-  for (const name of fs33.readdirSync(dir)) {
+  if (!fs34.existsSync(dir)) return;
+  for (const name of fs34.readdirSync(dir)) {
     if (name.endsWith(".db") || name.endsWith(".db-wal") || name.endsWith(".db-shm")) {
       try {
-        fs33.chmodSync(path33.join(dir, name), SECURE_FILE_MODE);
+        fs34.chmodSync(path35.join(dir, name), SECURE_FILE_MODE);
       } catch {
       }
     }
@@ -4215,7 +4215,7 @@ var init_fs_secure = __esm({
   }
 });
 function getUsersDBPath() {
-  return process.env["CODE_INTEL_USERS_DB_PATH"] ?? path33.join(os12.homedir(), ".code-intel", "users.db");
+  return process.env["CODE_INTEL_USERS_DB_PATH"] ?? path35.join(os12.homedir(), ".code-intel", "users.db");
 }
 function getOrCreateUsersDB() {
   if (!_usersDB) {
@@ -4231,7 +4231,7 @@ var init_users_db = __esm({
     UsersDB = class {
       db;
       constructor(dbPath) {
-        const dir = path33.dirname(dbPath);
+        const dir = path35.dirname(dbPath);
         secureMkdir(dir);
         this.db = new Database(dbPath);
         this.db.pragma("journal_mode = WAL");
@@ -4508,7 +4508,7 @@ function getScryptN() {
   return Number.isInteger(v) && v >= 1024 ? v : 1 << 14;
 }
 function getSecretsPath() {
-  return process.env["CODE_INTEL_SECRETS_PATH"] ?? path33.join(os12.homedir(), ".code-intel", ".secrets");
+  return process.env["CODE_INTEL_SECRETS_PATH"] ?? path35.join(os12.homedir(), ".code-intel", ".secrets");
 }
 function getMasterPassword() {
   const fromEnv = process.env["CODE_INTEL_SECRET_KEY"];
@@ -4550,12 +4550,12 @@ function decryptSecrets(encrypted) {
   return JSON.parse(plaintext.toString("utf8"));
 }
 function loadSecrets(secretsPath = getSecretsPath()) {
-  if (!fs33.existsSync(secretsPath)) return {};
-  const blob = fs33.readFileSync(secretsPath);
+  if (!fs34.existsSync(secretsPath)) return {};
+  const blob = fs34.readFileSync(secretsPath);
   return decryptSecrets(blob);
 }
 function saveSecrets(blob, secretsPath = getSecretsPath()) {
-  secureMkdir(path33.dirname(secretsPath));
+  secureMkdir(path35.dirname(secretsPath));
   const encrypted = encryptSecrets(blob);
   secureWriteFile(secretsPath, encrypted);
   secureChmodFile(secretsPath);
@@ -6039,14 +6039,14 @@ function detectDeadCode(graph) {
     if (meta?.deprecated === true) continue;
     if (ENTRY_POINT_NAME_RE.test(node.name)) continue;
     if (entryPointIds.has(node.id)) continue;
-    let hasCallers = false;
+    let hasCallers2 = false;
     for (const edge of graph.findEdgesTo(node.id)) {
       if (edge.kind === "calls") {
-        hasCallers = true;
+        hasCallers2 = true;
         break;
       }
     }
-    if (hasCallers) continue;
+    if (hasCallers2) continue;
     let hasImporters = false;
     for (const edge of graph.findEdgesTo(node.id)) {
       if (edge.kind === "imports") {
@@ -6298,6 +6298,550 @@ var init_health_score = __esm({
   }
 });
 
+// src/analysis/deprecated-detector.ts
+var deprecated_detector_exports = {};
+__export(deprecated_detector_exports, {
+  DeprecatedDetector: () => DeprecatedDetector
+});
+var BUILTIN_DEPRECATED, DeprecatedDetector;
+var init_deprecated_detector = __esm({
+  "src/analysis/deprecated-detector.ts"() {
+    BUILTIN_DEPRECATED = [
+      { pattern: "url.parse", message: "deprecated in Node.js v11.0.0 \u2014 use the WHATWG URL API instead" },
+      { pattern: "url.resolve", message: "deprecated in Node.js v11.0.0 \u2014 use the WHATWG URL API instead" },
+      { pattern: "url.format", message: "deprecated in Node.js v11.0.0 \u2014 use the WHATWG URL API instead" },
+      { pattern: "fs.exists", message: "deprecated \u2014 use fs.access instead" },
+      { pattern: "crypto.createCipher", message: "deprecated \u2014 use crypto.createCipheriv instead" },
+      { pattern: "crypto.createDecipher", message: "deprecated \u2014 use crypto.createDecipheriv instead" },
+      { pattern: "new Buffer()", message: "deprecated \u2014 use Buffer.from() instead" },
+      { pattern: "domain.create", message: "deprecated \u2014 the domain module is discouraged" },
+      { pattern: "process.binding", message: "deprecated internal API" }
+    ];
+    DeprecatedDetector = class {
+      tagDeprecated(graph) {
+        for (const node of graph.allNodes()) {
+          if (!node.metadata) node.metadata = {};
+          if (node.metadata["deprecated"] === true) continue;
+          let message;
+          const jsdoc = node.metadata["jsdoc"];
+          const comment = node.metadata["comment"];
+          if (jsdoc?.includes("@deprecated") || comment?.includes("@deprecated")) {
+            const src = jsdoc ?? comment ?? "";
+            const match = src.match(/@deprecated\s+(.*)/);
+            message = match?.[1]?.trim() || "deprecated";
+          }
+          if (!message && node.metadata["deprecated"] === true) {
+            message = node.metadata["deprecationMessage"] ?? "deprecated";
+          }
+          if (!message) {
+            const annotations = node.metadata["annotations"];
+            if (Array.isArray(annotations) && annotations.includes("Deprecated")) {
+              message = "marked @Deprecated";
+            }
+          }
+          if (!message) {
+            const attributes = node.metadata["attributes"];
+            if (Array.isArray(attributes) && attributes.includes("deprecated")) {
+              message = "marked #[deprecated]";
+            }
+          }
+          if (!message) {
+            for (const entry of BUILTIN_DEPRECATED) {
+              if (node.name === entry.pattern || node.name.includes(entry.pattern)) {
+                message = entry.message;
+                break;
+              }
+            }
+          }
+          if (message) {
+            node.metadata["deprecated"] = true;
+            node.metadata["deprecationMessage"] = message;
+          }
+        }
+      }
+      detect(graph, scope) {
+        const findings = [];
+        for (const node of graph.allNodes()) {
+          if (!node.metadata?.["deprecated"]) continue;
+          const callers = [];
+          for (const edge of graph.findEdgesTo(node.id)) {
+            if (edge.kind !== "calls" && edge.kind !== "deprecated_use") continue;
+            const caller = graph.getNode(edge.source);
+            if (!caller) continue;
+            if (scope && !caller.filePath.includes(scope)) continue;
+            callers.push({ name: caller.name, filePath: caller.filePath });
+            const edgeId = `dep_use_${edge.source}_${node.id}`;
+            if (!graph.getEdge(edgeId)) {
+              graph.addEdge({ id: edgeId, source: edge.source, target: node.id, kind: "deprecated_use" });
+            }
+          }
+          findings.push({
+            symbol: node.name,
+            filePath: node.filePath,
+            deprecationMessage: node.metadata?.["deprecationMessage"] ?? "deprecated",
+            callers
+          });
+        }
+        return findings;
+      }
+    };
+  }
+});
+
+// src/analysis/complexity.ts
+var complexity_exports = {};
+__export(complexity_exports, {
+  computeComplexity: () => computeComplexity
+});
+function getSeverity(cyclomatic) {
+  if (cyclomatic <= 5) return "LOW";
+  if (cyclomatic <= 10) return "MEDIUM";
+  if (cyclomatic <= 20) return "HIGH";
+  return "CRITICAL";
+}
+function computeComplexity(graph, scope) {
+  const results = [];
+  for (const node of graph.allNodes()) {
+    if (node.kind !== "function" && node.kind !== "method") continue;
+    if (scope && !node.filePath.startsWith(scope)) continue;
+    let outgoingCalls = 0;
+    for (const edge of graph.findEdgesFrom(node.id)) {
+      if (edge.kind === "calls") outgoingCalls++;
+    }
+    let cyclomatic;
+    const meta = node.metadata;
+    const metaComplexity = meta?.complexity;
+    if (typeof metaComplexity?.cyclomatic === "number") {
+      cyclomatic = metaComplexity.cyclomatic;
+    } else {
+      cyclomatic = 1 + Math.floor(outgoingCalls / 2);
+    }
+    cyclomatic = Math.min(cyclomatic, 50);
+    let cognitive;
+    if (typeof metaComplexity?.cognitive === "number") {
+      cognitive = metaComplexity.cognitive;
+    } else {
+      cognitive = Math.ceil(cyclomatic * 1.3);
+    }
+    results.push({
+      nodeId: node.id,
+      name: node.name,
+      filePath: node.filePath,
+      cyclomatic,
+      cognitive,
+      severity: getSeverity(cyclomatic)
+    });
+  }
+  return results.sort((a, b) => b.cyclomatic - a.cyclomatic);
+}
+var init_complexity = __esm({
+  "src/analysis/complexity.ts"() {
+  }
+});
+
+// src/analysis/test-coverage.ts
+var test_coverage_exports = {};
+__export(test_coverage_exports, {
+  computeCoverage: () => computeCoverage
+});
+function isTestFile(filePath) {
+  if (filePath.includes(".test.") || filePath.includes(".spec.")) return true;
+  if (filePath.includes("_test.") || filePath.endsWith("_test.go")) return true;
+  if (filePath.includes("__tests__")) return true;
+  const base = path35.basename(filePath);
+  if (base.startsWith("Test") && filePath.endsWith(".java")) return true;
+  return false;
+}
+function computeBlastRadius(graph, nodeId) {
+  const visited = /* @__PURE__ */ new Set();
+  const queue = [{ id: nodeId, depth: 0 }];
+  while (queue.length > 0) {
+    const { id, depth } = queue.shift();
+    if (visited.has(id)) continue;
+    visited.add(id);
+    if (depth >= 3) continue;
+    for (const edge of graph.findEdgesTo(id)) {
+      if (edge.kind === "calls" || edge.kind === "imports") {
+        if (!visited.has(edge.source)) {
+          queue.push({ id: edge.source, depth: depth + 1 });
+        }
+      }
+    }
+  }
+  return Math.max(0, visited.size - 1);
+}
+function getRisk(blastRadius) {
+  if (blastRadius > 20) return "HIGH";
+  if (blastRadius >= 5) return "MEDIUM";
+  return "LOW";
+}
+function computeCoverage(graph, scope) {
+  const testFilePaths = /* @__PURE__ */ new Set();
+  for (const node of graph.allNodes()) {
+    if (isTestFile(node.filePath)) testFilePaths.add(node.filePath);
+  }
+  const nodesImportedByTests = /* @__PURE__ */ new Set();
+  for (const edge of graph.findEdgesByKind("imports")) {
+    const sourceNode = graph.getNode(edge.source);
+    if (sourceNode && isTestFile(sourceNode.filePath)) {
+      nodesImportedByTests.add(edge.target);
+    }
+  }
+  const nodesWithTestedBy = /* @__PURE__ */ new Set();
+  for (const edge of graph.findEdgesByKind("tested_by")) {
+    nodesWithTestedBy.add(edge.source);
+  }
+  const baseNameToTestFiles = /* @__PURE__ */ new Map();
+  for (const testPath of testFilePaths) {
+    const base = path35.basename(testPath);
+    const stripped = base.replace(/\.test\.[^.]+$/, "").replace(/\.spec\.[^.]+$/, "").replace(/_test\.[^.]+$/, "").replace(/_test$/, "");
+    const existing = baseNameToTestFiles.get(stripped) ?? [];
+    existing.push(testPath);
+    baseNameToTestFiles.set(stripped, existing);
+  }
+  const exportedKinds = /* @__PURE__ */ new Set(["function", "method", "class"]);
+  const results = [];
+  for (const node of graph.allNodes()) {
+    if (!exportedKinds.has(node.kind)) continue;
+    if (node.exported !== true) continue;
+    if (scope && !node.filePath.startsWith(scope)) continue;
+    const testFiles = [];
+    if (nodesWithTestedBy.has(node.id)) {
+      for (const edge of graph.findEdgesFrom(node.id)) {
+        if (edge.kind === "tested_by") {
+          const testNode = graph.getNode(edge.target);
+          if (testNode && !testFiles.includes(testNode.filePath)) {
+            testFiles.push(testNode.filePath);
+          }
+        }
+      }
+    }
+    if (nodesImportedByTests.has(node.id)) {
+      for (const edge of graph.findEdgesTo(node.id)) {
+        if (edge.kind === "imports") {
+          const sourceNode = graph.getNode(edge.source);
+          if (sourceNode && isTestFile(sourceNode.filePath) && !testFiles.includes(sourceNode.filePath)) {
+            testFiles.push(sourceNode.filePath);
+          }
+        }
+      }
+    }
+    const nodeBase = path35.basename(node.filePath).replace(/\.[^.]+$/, "");
+    const matchingTestFiles = baseNameToTestFiles.get(nodeBase) ?? [];
+    for (const tf of matchingTestFiles) {
+      if (!testFiles.includes(tf)) testFiles.push(tf);
+    }
+    const tested = testFiles.length > 0;
+    const blastRadius = computeBlastRadius(graph, node.id);
+    const risk = getRisk(blastRadius);
+    results.push({
+      nodeId: node.id,
+      name: node.name,
+      filePath: node.filePath,
+      exported: true,
+      tested,
+      testFiles,
+      blastRadius,
+      risk
+    });
+  }
+  const totalExported = results.length;
+  const testedExported = results.filter((r) => r.tested).length;
+  const coveragePct = totalExported === 0 ? 100 : Math.round(testedExported / totalExported * 100);
+  const untestedByRisk = results.filter((r) => !r.tested).sort((a, b) => b.blastRadius - a.blastRadius);
+  return { totalExported, testedExported, coveragePct, untestedByRisk };
+}
+var init_test_coverage = __esm({
+  "src/analysis/test-coverage.ts"() {
+  }
+});
+
+// src/security/secret-scanner.ts
+var secret_scanner_exports = {};
+__export(secret_scanner_exports, {
+  SecretScanner: () => SecretScanner
+});
+function shannonEntropy(s) {
+  const freq = /* @__PURE__ */ new Map();
+  for (const c of s) freq.set(c, (freq.get(c) ?? 0) + 1);
+  let entropy = 0;
+  for (const count of freq.values()) {
+    const p = count / s.length;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+function isTestFile2(filePath) {
+  return filePath.includes(".test.") || filePath.includes(".spec.") || filePath.includes("fixtures/") || filePath.includes("mocks/");
+}
+var ENV_VAR_RE, SENSITIVE_NAME_RE, VALUE_PATTERNS, SecretScanner;
+var init_secret_scanner = __esm({
+  "src/security/secret-scanner.ts"() {
+    ENV_VAR_RE = /^process\.env\./;
+    SENSITIVE_NAME_RE = /_SECRET$|_PASSWORD$|_TOKEN$|_KEY$|_API_KEY$/i;
+    VALUE_PATTERNS = [
+      [/sk-[A-Za-z0-9]{6,}/, "openai-api-key", "HIGH"],
+      [/pk_live_[A-Za-z0-9]{20,}/, "stripe-key", "HIGH"],
+      [/AKIA[0-9A-Z]{16}|aws.access.key/i, "aws-access-key", "HIGH"],
+      [/xoxb-[0-9]{11}-[0-9]{11}-[A-Za-z0-9]{24}/, "slack-token", "HIGH"],
+      [/postgres:\/\/[^@]+:[^@]+@/, "db-url-with-credentials", "HIGH"],
+      [/mysql:\/\/[^@]+:[^@]+@/, "db-url-with-credentials", "HIGH"],
+      [/-----BEGIN RSA PRIVATE KEY-----/, "rsa-private-key", "HIGH"]
+    ];
+    SecretScanner = class {
+      scan(graph, options) {
+        const findings = [];
+        const includeTests = options?.includeTestFiles ?? false;
+        const scope = options?.scope;
+        const ignorePatterns = [...options?.ignorePatterns ?? []];
+        if (options?.workspaceRoot) {
+          try {
+            const raw = fs34.readFileSync(path35.join(options.workspaceRoot, ".codeintelignore"), "utf-8");
+            for (const line of raw.split("\n")) {
+              const trimmed = line.trim();
+              if (trimmed && !trimmed.startsWith("#")) ignorePatterns.push(trimmed);
+            }
+          } catch {
+          }
+        }
+        for (const node of graph.allNodes()) {
+          const filePath = node.filePath;
+          if (scope && !filePath.startsWith(scope)) continue;
+          if (!includeTests && isTestFile2(filePath)) continue;
+          if (ignorePatterns.length > 0 && ignorePatterns.some((p) => filePath.includes(p))) continue;
+          const meta = node.metadata;
+          const rawValue = meta?.value ?? meta?.literalValue;
+          if (typeof rawValue !== "string" || rawValue.trim() === "") continue;
+          const value = rawValue.trim();
+          if (ENV_VAR_RE.test(value)) continue;
+          let matched = false;
+          for (const [re, label, severity] of VALUE_PATTERNS) {
+            if (re.test(value)) {
+              node.metadata = {
+                ...node.metadata ?? {},
+                security: { secretRisk: true, secretPattern: label }
+              };
+              findings.push({
+                file: filePath,
+                line: node.startLine,
+                symbol: node.name,
+                pattern: label,
+                severity
+              });
+              matched = true;
+              break;
+            }
+          }
+          if (matched) continue;
+          if (SENSITIVE_NAME_RE.test(node.name)) {
+            node.metadata = {
+              ...node.metadata ?? {},
+              security: { secretRisk: true, secretPattern: "sensitive-name-with-value" }
+            };
+            findings.push({
+              file: filePath,
+              line: node.startLine,
+              symbol: node.name,
+              pattern: "sensitive-name-with-value",
+              severity: "MEDIUM"
+            });
+            continue;
+          }
+          if (SENSITIVE_NAME_RE.test(node.name) && value.length > 20 && shannonEntropy(value) > 4.5) {
+            node.metadata = {
+              ...node.metadata ?? {},
+              security: { secretRisk: true, secretPattern: "high-entropy-string" }
+            };
+            findings.push({
+              file: filePath,
+              line: node.startLine,
+              symbol: node.name,
+              pattern: "high-entropy-string",
+              severity: "MEDIUM"
+            });
+          }
+        }
+        return findings;
+      }
+    };
+  }
+});
+
+// src/security/vulnerability-detector.ts
+var vulnerability_detector_exports = {};
+__export(vulnerability_detector_exports, {
+  VulnerabilityDetector: () => VulnerabilityDetector
+});
+function hasCallers(graph, nodeId) {
+  for (const edge of graph.findEdgesTo(nodeId)) {
+    if (edge.kind === "calls") return true;
+  }
+  return false;
+}
+var CWE, SQL_PATTERN, XSS_PATTERN, SSRF_PATTERN, PATH_PATTERN, CMD_PATTERN, VulnerabilityDetector;
+var init_vulnerability_detector = __esm({
+  "src/security/vulnerability-detector.ts"() {
+    CWE = {
+      SQL_INJECTION: "CWE-89",
+      XSS: "CWE-79",
+      SSRF: "CWE-918",
+      PATH_TRAVERSAL: "CWE-22",
+      COMMAND_INJECTION: "CWE-78"
+    };
+    SQL_PATTERN = /(db|database|connection|knex|sequelize|pool)\.(query|execute|raw)/i;
+    XSS_PATTERN = /innerHTML|outerHTML|document\.write|insertAdjacentHTML/i;
+    SSRF_PATTERN = /^(fetch|axios|http\.request|got)$/i;
+    PATH_PATTERN = /^(fs\.readFile|fs\.writeFile|path\.join|createReadStream)$/i;
+    CMD_PATTERN = /^(exec|execSync|spawn|eval)$/i;
+    VulnerabilityDetector = class {
+      detect(graph, options) {
+        const findings = [];
+        const scope = options?.scope;
+        const types = options?.types ? new Set(options.types) : null;
+        const want = (t) => !types || types.has(t);
+        const nodes = [...graph.allNodes()];
+        for (const node of nodes) {
+          if (node.kind === "vulnerability") continue;
+          const filePath = node.filePath;
+          if (scope && !filePath.startsWith(scope)) continue;
+          const nodeName = node.name;
+          const meta = node.metadata;
+          if (want("SQL_INJECTION") && SQL_PATTERN.test(nodeName)) {
+            const hasDynamic = meta?.hasStringConcatenation === true || hasCallers(graph, node.id);
+            if (hasDynamic) {
+              findings.push({
+                type: "SQL_INJECTION",
+                severity: "MEDIUM",
+                file: filePath,
+                line: node.startLine,
+                symbol: nodeName,
+                description: `Potential SQL injection: ${nodeName} may execute unsanitized user input`,
+                cweId: CWE["SQL_INJECTION"]
+              });
+              this._tagNode(graph, node.id, "SQL_INJECTION");
+            }
+          }
+          if (want("XSS") && XSS_PATTERN.test(nodeName)) {
+            findings.push({
+              type: "XSS",
+              severity: "HIGH",
+              file: filePath,
+              line: node.startLine,
+              symbol: nodeName,
+              description: `Potential XSS: ${nodeName} writes to DOM sink`,
+              cweId: CWE["XSS"]
+            });
+            this._tagNode(graph, node.id, "XSS");
+          }
+          if (want("XSS")) {
+            for (const edge of graph.findEdgesFrom(node.id)) {
+              if (edge.kind === "calls") {
+                const callee = graph.getNode(edge.target);
+                if (callee && XSS_PATTERN.test(callee.name)) {
+                  findings.push({
+                    type: "XSS",
+                    severity: "HIGH",
+                    file: filePath,
+                    line: node.startLine,
+                    symbol: node.name,
+                    description: `Potential XSS: ${node.name} calls ${callee.name}`,
+                    cweId: CWE["XSS"]
+                  });
+                  this._tagNode(graph, node.id, "XSS");
+                }
+              }
+            }
+          }
+          if (want("SSRF") && SSRF_PATTERN.test(nodeName)) {
+            const isDynamic = meta?.dynamicUrl === true;
+            if (isDynamic) {
+              findings.push({
+                type: "SSRF",
+                severity: "HIGH",
+                file: filePath,
+                line: node.startLine,
+                symbol: nodeName,
+                description: `Potential SSRF: ${nodeName} uses a dynamic URL`,
+                cweId: CWE["SSRF"]
+              });
+              this._tagNode(graph, node.id, "SSRF");
+            }
+          }
+          if (want("PATH_TRAVERSAL") && PATH_PATTERN.test(nodeName)) {
+            const isDynamic = meta?.dynamicPath === true;
+            if (isDynamic) {
+              findings.push({
+                type: "PATH_TRAVERSAL",
+                severity: "HIGH",
+                file: filePath,
+                line: node.startLine,
+                symbol: nodeName,
+                description: `Potential path traversal: ${nodeName} uses a dynamic path`,
+                cweId: CWE["PATH_TRAVERSAL"]
+              });
+              this._tagNode(graph, node.id, "PATH_TRAVERSAL");
+            }
+          }
+          if (want("COMMAND_INJECTION") && CMD_PATTERN.test(nodeName)) {
+            const isDynamic = meta?.dynamicArgs === true;
+            if (isDynamic) {
+              findings.push({
+                type: "COMMAND_INJECTION",
+                severity: "HIGH",
+                file: filePath,
+                line: node.startLine,
+                symbol: nodeName,
+                description: `Potential command injection: ${nodeName} uses dynamic arguments`,
+                cweId: CWE["COMMAND_INJECTION"]
+              });
+              this._tagNode(graph, node.id, "COMMAND_INJECTION");
+            }
+          }
+        }
+        const seen = /* @__PURE__ */ new Set();
+        return findings.filter((f) => {
+          const key = `${f.type}:${f.file}:${f.line}:${f.symbol}`;
+          if (seen.has(key)) return false;
+          seen.add(key);
+          return true;
+        });
+      }
+      _tagNode(graph, nodeId, vulnType) {
+        const node = graph.getNode(nodeId);
+        if (!node) return;
+        const meta = node.metadata ?? {};
+        node.metadata = {
+          ...meta,
+          security: {
+            ...meta["security"] ?? {},
+            vulnerability: vulnType
+          }
+        };
+        const vulnNodeId = `vuln:${vulnType}:${nodeId}`;
+        if (!graph.getNode(vulnNodeId)) {
+          graph.addNode({
+            id: vulnNodeId,
+            kind: "vulnerability",
+            name: `${vulnType}:${node.name}`,
+            filePath: node.filePath,
+            startLine: node.startLine,
+            metadata: { cweId: CWE[vulnType], vulnType }
+          });
+        }
+        const edgeId = `has_vulnerability:${nodeId}:${vulnNodeId}`;
+        if (!graph.getEdge(edgeId)) {
+          graph.addEdge({
+            id: edgeId,
+            source: nodeId,
+            target: vulnNodeId,
+            kind: "has_vulnerability"
+          });
+        }
+      }
+    };
+  }
+});
+
 // src/pipeline/file-watcher.ts
 var file_watcher_exports = {};
 __export(file_watcher_exports, {
@@ -6376,10 +6920,10 @@ var init_file_watcher = __esm({
       }
       // ── private ─────────────────────────────────────────────────────────────────
       readCodeIntelIgnore() {
-        const ignoreFile = path33.join(this.workspaceRoot, ".codeintelignore");
+        const ignoreFile = path35.join(this.workspaceRoot, ".codeintelignore");
         try {
-          if (!fs33.existsSync(ignoreFile)) return [];
-          return fs33.readFileSync(ignoreFile, "utf-8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+          if (!fs34.existsSync(ignoreFile)) return [];
+          return fs34.readFileSync(ignoreFile, "utf-8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
         } catch {
           return [];
         }
@@ -6431,7 +6975,7 @@ var init_incremental_indexer = __esm({
         }
         const nodeIdsToRemove = /* @__PURE__ */ new Set();
         for (const absPath of changedFiles) {
-          const relPath2 = path33.relative(workspaceRoot, absPath);
+          const relPath2 = path35.relative(workspaceRoot, absPath);
           for (const id of nodesByFilePath.get(relPath2) ?? []) nodeIdsToRemove.add(id);
           for (const id of nodesByFilePath.get(absPath) ?? []) nodeIdsToRemove.add(id);
         }
@@ -6439,12 +6983,12 @@ var init_incremental_indexer = __esm({
           graph.removeNodeCascade(id);
           nodesRemoved++;
         }
-        if (fs33.existsSync(dbPath)) {
+        if (fs34.existsSync(dbPath)) {
           try {
             const db = new DbManager(dbPath);
             await db.init();
             for (const absPath of changedFiles) {
-              const relPath2 = path33.relative(workspaceRoot, absPath);
+              const relPath2 = path35.relative(workspaceRoot, absPath);
               await removeNodesForFile(relPath2, db);
             }
             db.close();
@@ -6454,7 +6998,7 @@ var init_incremental_indexer = __esm({
         }
         const existingFiles = changedFiles.filter((f) => {
           try {
-            return fs33.statSync(f).isFile();
+            return fs34.statSync(f).isFile();
           } catch {
             return false;
           }
@@ -6476,13 +7020,13 @@ var init_incremental_indexer = __esm({
           await runPipeline([noopScan, parsePhase, resolvePhase], context2);
         }
         const nodesAdded = Math.max(0, graph.size.nodes - (nodesBeforeParse - nodesRemoved));
-        if (fs33.existsSync(dbPath) && existingFiles.length > 0) {
+        if (fs34.existsSync(dbPath) && existingFiles.length > 0) {
           try {
             const db = new DbManager(dbPath);
             await db.init();
-            const changedRelPaths = new Set(changedFiles.map((f) => path33.relative(workspaceRoot, f)));
+            const changedRelPaths = new Set(changedFiles.map((f) => path35.relative(workspaceRoot, f)));
             const nodesToUpsert = [...graph.allNodes()].filter(
-              (n) => changedRelPaths.has(n.filePath) || changedRelPaths.has(path33.relative(workspaceRoot, n.filePath))
+              (n) => changedRelPaths.has(n.filePath) || changedRelPaths.has(path35.relative(workspaceRoot, n.filePath))
             );
             await upsertNodes(nodesToUpsert, db);
             db.close();
@@ -6513,35 +7057,35 @@ __export(saved_queries_exports, {
   saveQuery: () => saveQuery
 });
 function getQueriesDir(workspaceRoot) {
-  return path33.join(workspaceRoot, ".code-intel", "queries");
+  return path35.join(workspaceRoot, ".code-intel", "queries");
 }
 function ensureQueriesDir(workspaceRoot) {
   const dir = getQueriesDir(workspaceRoot);
-  if (!fs33.existsSync(dir)) {
-    fs33.mkdirSync(dir, { recursive: true });
+  if (!fs34.existsSync(dir)) {
+    fs34.mkdirSync(dir, { recursive: true });
   }
   return dir;
 }
 function saveQuery(workspaceRoot, name, gql) {
   const dir = ensureQueriesDir(workspaceRoot);
-  const filePath = path33.join(dir, `${name}.gql`);
-  fs33.writeFileSync(filePath, gql, "utf-8");
+  const filePath = path35.join(dir, `${name}.gql`);
+  fs34.writeFileSync(filePath, gql, "utf-8");
 }
 function loadQuery(workspaceRoot, name) {
   const dir = getQueriesDir(workspaceRoot);
-  const filePath = path33.join(dir, `${name}.gql`);
-  if (!fs33.existsSync(filePath)) return null;
-  return fs33.readFileSync(filePath, "utf-8");
+  const filePath = path35.join(dir, `${name}.gql`);
+  if (!fs34.existsSync(filePath)) return null;
+  return fs34.readFileSync(filePath, "utf-8");
 }
 function listQueries(workspaceRoot) {
   const dir = getQueriesDir(workspaceRoot);
-  if (!fs33.existsSync(dir)) return [];
-  const files = fs33.readdirSync(dir).filter((f) => f.endsWith(".gql"));
+  if (!fs34.existsSync(dir)) return [];
+  const files = fs34.readdirSync(dir).filter((f) => f.endsWith(".gql"));
   return files.map((f) => {
-    const filePath = path33.join(dir, f);
+    const filePath = path35.join(dir, f);
     const name = f.replace(/\.gql$/, "");
-    const content = fs33.readFileSync(filePath, "utf-8");
-    const stat = fs33.statSync(filePath);
+    const content = fs34.readFileSync(filePath, "utf-8");
+    const stat = fs34.statSync(filePath);
     return {
       name,
       content,
@@ -6552,15 +7096,15 @@ function listQueries(workspaceRoot) {
 }
 function deleteQuery(workspaceRoot, name) {
   const dir = getQueriesDir(workspaceRoot);
-  const filePath = path33.join(dir, `${name}.gql`);
-  if (!fs33.existsSync(filePath)) return false;
-  fs33.unlinkSync(filePath);
+  const filePath = path35.join(dir, `${name}.gql`);
+  if (!fs34.existsSync(filePath)) return false;
+  fs34.unlinkSync(filePath);
   return true;
 }
 function queryExists(workspaceRoot, name) {
   const dir = getQueriesDir(workspaceRoot);
-  const filePath = path33.join(dir, `${name}.gql`);
-  return fs33.existsSync(filePath);
+  const filePath = path35.join(dir, `${name}.gql`);
+  return fs34.existsSync(filePath);
 }
 var init_saved_queries = __esm({
   "src/query/saved-queries.ts"() {
@@ -6669,7 +7213,7 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
 ]);
 function loadIgnorePatterns(workspaceRoot) {
   try {
-    const raw = fs33.readFileSync(path33.join(workspaceRoot, ".codeintelignore"), "utf-8");
+    const raw = fs34.readFileSync(path35.join(workspaceRoot, ".codeintelignore"), "utf-8");
     const extras = /* @__PURE__ */ new Set();
     for (const line of raw.split("\n")) {
       const trimmed = line.trim();
@@ -6693,7 +7237,7 @@ var scanPhase = {
     function walk2(dir) {
       let entries;
       try {
-        entries = fs33.readdirSync(dir, { withFileTypes: true });
+        entries = fs34.readdirSync(dir, { withFileTypes: true });
       } catch {
         return;
       }
@@ -6702,15 +7246,15 @@ var scanPhase = {
           if (entry.name.startsWith(".")) continue;
           if (IGNORED_DIRS.has(entry.name)) continue;
           if (extraIgnore.has(entry.name)) continue;
-          walk2(path33.join(dir, entry.name));
+          walk2(path35.join(dir, entry.name));
         } else if (entry.isFile()) {
           const name = entry.name;
           if (IGNORED_FILE_SUFFIXES.some((s) => name.endsWith(s))) continue;
-          const ext = path33.extname(name);
+          const ext = path35.extname(name);
           if (!extensions.has(ext)) continue;
-          const fullPath = path33.join(dir, name);
+          const fullPath = path35.join(dir, name);
           try {
-            const stat = fs33.statSync(fullPath);
+            const stat = fs34.statSync(fullPath);
             if (stat.size > MAX_FILE_SIZE_BYTES) continue;
           } catch {
             continue;
@@ -6737,20 +7281,20 @@ var structurePhase = {
     const dirs = /* @__PURE__ */ new Set();
     let structDone = 0;
     for (const filePath of context2.filePaths) {
-      const relativePath = path33.relative(context2.workspaceRoot, filePath);
+      const relativePath = path35.relative(context2.workspaceRoot, filePath);
       const lang = detectLanguage(filePath);
       context2.graph.addNode({
         id: generateNodeId("file", relativePath, relativePath),
         kind: "file",
-        name: path33.basename(filePath),
+        name: path35.basename(filePath),
         filePath: relativePath,
         metadata: lang ? { language: lang } : void 0
       });
-      let dir = path33.dirname(relativePath);
+      let dir = path35.dirname(relativePath);
       while (dir && dir !== "." && dir !== "") {
         if (dirs.has(dir)) break;
         dirs.add(dir);
-        dir = path33.dirname(dir);
+        dir = path35.dirname(dir);
       }
       structDone++;
       context2.onPhaseProgress?.("structure", structDone, context2.filePaths.length);
@@ -6759,7 +7303,7 @@ var structurePhase = {
       context2.graph.addNode({
         id: generateNodeId("directory", dir, dir),
         kind: "directory",
-        name: path33.basename(dir),
+        name: path35.basename(dir),
         filePath: dir
       });
     }
@@ -6846,9 +7390,9 @@ var flowPhase = {
     for (const node of graph.allNodes()) {
       if (!["function", "method"].includes(node.kind)) continue;
       let score = 0;
-      const hasCallers = calledNodes.has(node.id);
+      const hasCallers2 = calledNodes.has(node.id);
       const outCalls = [...graph.findEdgesFrom(node.id)].filter((e) => e.kind === "calls");
-      if (!hasCallers && outCalls.length > 0) score += 10;
+      if (!hasCallers2 && outCalls.length > 0) score += 10;
       if (node.exported) score += 5;
       if (/^(main|handle|init|start|run|execute|process|serve|listen|bootstrap)/.test(node.name)) score += 3;
       if (node.filePath.includes("test") || node.filePath.includes("spec") || node.filePath.includes("__test")) score -= 20;
@@ -6870,22 +7414,22 @@ var flowPhase = {
       const queue = [{ nodeId: ep.id, path: [ep.id] }];
       const visited = /* @__PURE__ */ new Set();
       while (queue.length > 0 && flowCount < maxFlows) {
-        const { nodeId, path: path34 } = queue.shift();
-        if (path34.length > maxDepth) continue;
+        const { nodeId, path: path36 } = queue.shift();
+        if (path36.length > maxDepth) continue;
         const callEdges = [...graph.findEdgesFrom(nodeId)].filter((e) => e.kind === "calls").slice(0, maxBranching);
-        if (callEdges.length === 0 && path34.length >= 3) {
+        if (callEdges.length === 0 && path36.length >= 3) {
           const flowId = generateNodeId("flow", ep.filePath, `flow-${flowCount}`);
           graph.addNode({
             id: flowId,
             kind: "flow",
             name: `${ep.name} flow ${flowCount}`,
             filePath: ep.filePath,
-            metadata: { steps: path34, entryPoint: ep.name }
+            metadata: { steps: path36, entryPoint: ep.name }
           });
-          for (let i = 0; i < path34.length; i++) {
+          for (let i = 0; i < path36.length; i++) {
             graph.addEdge({
-              id: generateEdgeId(path34[i], flowId, `step_of_${i}`),
-              source: path34[i],
+              id: generateEdgeId(path36[i], flowId, `step_of_${i}`),
+              source: path36[i],
               target: flowId,
               kind: "step_of",
               weight: 1,
@@ -6898,7 +7442,7 @@ var flowPhase = {
         for (const edge of callEdges) {
           if (visited.has(edge.target)) continue;
           visited.add(edge.target);
-          queue.push({ nodeId: edge.target, path: [...path34, edge.target] });
+          queue.push({ nodeId: edge.target, path: [...path36, edge.target] });
         }
       }
     }
@@ -6916,7 +7460,7 @@ var LLMGovernanceLogger = class {
   }
   /** Path to the JSONL log file. */
   getLogPath() {
-    return process.env["CODE_INTEL_GOVERNANCE_LOG_PATH"] ?? path33.join(os12.homedir(), ".code-intel", "llm-governance.jsonl");
+    return process.env["CODE_INTEL_GOVERNANCE_LOG_PATH"] ?? path35.join(os12.homedir(), ".code-intel", "llm-governance.jsonl");
   }
   /**
    * Append an entry to the governance log.
@@ -6932,8 +7476,8 @@ var LLMGovernanceLogger = class {
         ...entry
       };
       const logPath = this.getLogPath();
-      fs33.mkdirSync(path33.dirname(logPath), { recursive: true });
-      fs33.appendFileSync(logPath, JSON.stringify(full) + "\n", "utf-8");
+      fs34.mkdirSync(path35.dirname(logPath), { recursive: true });
+      fs34.appendFileSync(logPath, JSON.stringify(full) + "\n", "utf-8");
     } catch {
     }
   }
@@ -6943,7 +7487,7 @@ var LLMGovernanceLogger = class {
    */
   readLog(limit = 100) {
     try {
-      const raw = fs33.readFileSync(this.getLogPath(), "utf-8");
+      const raw = fs34.readFileSync(this.getLogPath(), "utf-8");
       const lines = raw.split("\n").filter((l) => l.trim().length > 0).slice(-limit);
       return lines.map((l) => JSON.parse(l));
     } catch {
@@ -7257,7 +7801,7 @@ var LANG_QUERIES2 = {
 };
 function workerScriptPath() {
   const thisFile = fileURLToPath(import.meta.url);
-  return path33.join(path33.dirname(thisFile), "parse-worker.js");
+  return path35.join(path35.dirname(thisFile), "parse-worker.js");
 }
 var parsePhaseParallel = {
   name: "parse",
@@ -7273,14 +7817,14 @@ var parsePhaseParallel = {
       const batch = filePaths.slice(i, i + CONCURRENCY);
       await Promise.all(batch.map(async (filePath) => {
         try {
-          const source = await fs33.promises.readFile(filePath, "utf-8");
+          const source = await fs34.promises.readFile(filePath, "utf-8");
           context2.fileCache.set(filePath, source);
         } catch {
         }
       }));
     }
     const workerScript = workerScriptPath();
-    const workerScriptExists = fs33.existsSync(workerScript);
+    const workerScriptExists = fs34.existsSync(workerScript);
     if (!workerScriptExists || workerCount === 1) {
       logger_default.info(`[parse-parallel] falling back to sequential (workerCount=${workerCount}, scriptExists=${workerScriptExists})`);
       const { parsePhase: parsePhase2 } = await Promise.resolve().then(() => (init_parse_phase(), parse_phase_exports));
@@ -7292,7 +7836,7 @@ var parsePhaseParallel = {
       if (!lang) continue;
       const source = context2.fileCache.get(filePath);
       if (!source) continue;
-      const relativePath = path33.relative(context2.workspaceRoot, filePath);
+      const relativePath = path35.relative(context2.workspaceRoot, filePath);
       const fileNodeId = generateNodeId("file", relativePath, relativePath);
       const fileNode = context2.graph.getNode(fileNodeId);
       if (fileNode) fileNode.content = source.slice(0, 2e3);
@@ -7335,7 +7879,7 @@ var parsePhaseParallel = {
         symbolCount += res.nodes.length;
         if (res.usedTreeSitter) treeSitterCount++;
         else regexCount++;
-        const relativePath = path33.relative(context2.workspaceRoot, res.taskId);
+        const relativePath = path35.relative(context2.workspaceRoot, res.taskId);
         const funcs = res.nodes.filter((n) => n.kind === "function" || n.kind === "method").map((n) => ({ id: n.id, startLine: n.startLine ?? 0, endLine: n.endLine })).sort((a, b) => a.startLine - b.startLine);
         if (funcs.length > 0) context2.fileFunctionIndex.set(relativePath, funcs);
         parseDone++;
@@ -7362,7 +7906,7 @@ init_id_generator();
 init_logger();
 function workerScriptPath2() {
   const thisFile = fileURLToPath(import.meta.url);
-  return path33.join(path33.dirname(thisFile), "resolve-worker.js");
+  return path35.join(path35.dirname(thisFile), "resolve-worker.js");
 }
 var resolvePhaseParallel = {
   name: "resolve",
@@ -7374,11 +7918,11 @@ var resolvePhaseParallel = {
     const fileFunctionIndex = context2.fileFunctionIndex ?? /* @__PURE__ */ new Map();
     const fileIndex = {};
     for (const fp of filePaths) {
-      const rel = path33.relative(workspaceRoot, fp);
+      const rel = path35.relative(workspaceRoot, fp);
       fileIndex[rel] = fp;
       const noExt = rel.replace(/\.\w+$/, "");
       if (!fileIndex[noExt]) fileIndex[noExt] = fp;
-      const base = path33.basename(rel, path33.extname(rel));
+      const base = path35.basename(rel, path35.extname(rel));
       if (!fileIndex[base]) fileIndex[base] = fp;
     }
     const symbolIndex = {};
@@ -7392,7 +7936,7 @@ var resolvePhaseParallel = {
     }
     const snapshot = { symbolIndex, fileSymbolIndex, fileIndex, workspaceRoot };
     const workerScript = workerScriptPath2();
-    const workerScriptExists = fs33.existsSync(workerScript);
+    const workerScriptExists = fs34.existsSync(workerScript);
     const workerCount = parseInt(process.env["PARSE_WORKERS"] ?? "", 10) || Math.max(1, os12.cpus().length - 1);
     if (!workerScriptExists || workerCount === 1) {
       logger_default.info(`[resolve-parallel] falling back to sequential`);
@@ -7405,7 +7949,7 @@ var resolvePhaseParallel = {
       if (!lang) continue;
       const source = fileCache.get(filePath);
       if (!source) continue;
-      const relativePath = path33.relative(workspaceRoot, filePath);
+      const relativePath = path35.relative(workspaceRoot, filePath);
       const fileNodeId = generateNodeId("file", relativePath, relativePath);
       const funcList = fileFunctionIndex.get(relativePath) ?? [];
       tasks.push({ taskId: filePath, filePath, relativePath, fileNodeId, source, funcList });
@@ -7528,7 +8072,7 @@ init_embedder();
 async function hybridSearch(graph, query, limit, options = {}) {
   const { vectorDbPath, bm25Limit = 50, vectorLimit = 50 } = options;
   const bm25Promise = Promise.resolve(textSearch(graph, query, bm25Limit));
-  const hasVectorDb = Boolean(vectorDbPath && fs33.existsSync(vectorDbPath));
+  const hasVectorDb = Boolean(vectorDbPath && fs34.existsSync(vectorDbPath));
   if (!hasVectorDb) {
     const bm25Results2 = await bm25Promise;
     return {
@@ -7595,8 +8139,8 @@ async function queryGroup(group, query, limit = 20) {
   for (const member of group.members) {
     const regEntry = registry.find((r) => r.name === member.registryName);
     if (!regEntry) continue;
-    const dbPath = path33.join(regEntry.path, ".code-intel", "graph.db");
-    if (!fs33.existsSync(dbPath)) continue;
+    const dbPath = path35.join(regEntry.path, ".code-intel", "graph.db");
+    if (!fs34.existsSync(dbPath)) continue;
     const graph = createKnowledgeGraph();
     const db = new DbManager(dbPath);
     try {
@@ -7638,7 +8182,7 @@ var STUCK_THRESHOLD_MINUTES = 30;
 var JobsDB = class {
   db;
   constructor(dbPath) {
-    fs33.mkdirSync(path33.dirname(dbPath), { recursive: true });
+    fs34.mkdirSync(path35.dirname(dbPath), { recursive: true });
     this.db = new Database(dbPath);
     this.db.pragma("journal_mode = WAL");
     this.db.pragma("foreign_keys = ON");
@@ -7780,7 +8324,7 @@ var JobsDB = class {
   }
 };
 function getJobsDBPath() {
-  return path33.join(os12.homedir(), ".code-intel", "jobs.db");
+  return path35.join(os12.homedir(), ".code-intel", "jobs.db");
 }
 var _jobsDB = null;
 function getOrCreateJobsDB() {
@@ -7872,7 +8416,7 @@ var BACKUP_VERSION = "1.0";
 var ALGORITHM = "aes-256-gcm";
 var IV_LENGTH = 16;
 function getBackupDir() {
-  return path33.join(os12.homedir(), ".code-intel", "backups");
+  return path35.join(os12.homedir(), ".code-intel", "backups");
 }
 function getBackupKey() {
   const keyHex = process.env["CODE_INTEL_BACKUP_KEY"];
@@ -7903,30 +8447,30 @@ var BackupService = class {
   constructor(backupDir) {
     this.backupDir = backupDir ?? getBackupDir();
     this.key = getBackupKey();
-    fs33.mkdirSync(this.backupDir, { recursive: true });
+    fs34.mkdirSync(this.backupDir, { recursive: true });
   }
   /**
    * Create a backup for a repository.
    * Returns the backup entry.
    */
   createBackup(repoPath) {
-    const codeIntelDir = path33.join(repoPath, ".code-intel");
+    const codeIntelDir = path35.join(repoPath, ".code-intel");
     const id = v4();
     const createdAt = (/* @__PURE__ */ new Date()).toISOString();
     const filesToBackup = [];
     const candidates = ["graph.db", "vector.db", "meta.json"];
     for (const f of candidates) {
-      const fp = path33.join(codeIntelDir, f);
-      if (fs33.existsSync(fp)) {
+      const fp = path35.join(codeIntelDir, f);
+      if (fs34.existsSync(fp)) {
         filesToBackup.push({ name: f, localPath: fp });
       }
     }
-    const registryPath = path33.join(os12.homedir(), ".code-intel", "registry.json");
-    if (fs33.existsSync(registryPath)) {
+    const registryPath = path35.join(os12.homedir(), ".code-intel", "registry.json");
+    if (fs34.existsSync(registryPath)) {
       filesToBackup.push({ name: "registry.json", localPath: registryPath });
     }
-    const usersDbPath = path33.join(os12.homedir(), ".code-intel", "users.db");
-    if (fs33.existsSync(usersDbPath)) {
+    const usersDbPath = path35.join(os12.homedir(), ".code-intel", "users.db");
+    if (fs34.existsSync(usersDbPath)) {
       filesToBackup.push({ name: "users.db", localPath: usersDbPath });
     }
     if (filesToBackup.length === 0) {
@@ -7937,7 +8481,7 @@ var BackupService = class {
       createdAt,
       version: BACKUP_VERSION,
       files: filesToBackup.map((f) => {
-        const data = fs33.readFileSync(f.localPath);
+        const data = fs34.readFileSync(f.localPath);
         return {
           name: f.name,
           sha256: crypto5.createHash("sha256").update(data).digest("hex"),
@@ -7951,7 +8495,7 @@ var BackupService = class {
     manifestLenBuf.writeUInt32BE(manifestBuf.length, 0);
     parts.push(manifestLenBuf, manifestBuf);
     for (const f of filesToBackup) {
-      const data = fs33.readFileSync(f.localPath);
+      const data = fs34.readFileSync(f.localPath);
       const nameBuf = Buffer.from(f.name, "utf-8");
       const nameLenBuf = Buffer.alloc(2);
       nameLenBuf.writeUInt16BE(nameBuf.length, 0);
@@ -7962,8 +8506,8 @@ var BackupService = class {
     const plaintext = Buffer.concat(parts);
     const encrypted = encryptBuffer(plaintext, this.key);
     const backupFileName = `backup-${id}.cib`;
-    const backupPath = path33.join(this.backupDir, backupFileName);
-    fs33.writeFileSync(backupPath, encrypted);
+    const backupPath = path35.join(this.backupDir, backupFileName);
+    fs34.writeFileSync(backupPath, encrypted);
     const entry = {
       id,
       createdAt,
@@ -7990,9 +8534,9 @@ var BackupService = class {
   async uploadToS3(entry) {
     const cfg = getS3Config();
     if (!cfg) throw new Error("S3 not configured. Set CODE_INTEL_BACKUP_S3_BUCKET, CODE_INTEL_BACKUP_S3_ACCESS_KEY_ID, CODE_INTEL_BACKUP_S3_SECRET_ACCESS_KEY.");
-    const fileName = path33.basename(entry.path);
+    const fileName = path35.basename(entry.path);
     const s3Key = `${cfg.prefix}${fileName}`;
-    const body = fs33.readFileSync(entry.path);
+    const body = fs34.readFileSync(entry.path);
     const result = await s3Request({ method: "PUT", cfg, key: s3Key, body });
     if (result.statusCode < 200 || result.statusCode >= 300) {
       throw new Error(`S3 upload failed (HTTP ${result.statusCode}): ${result.body.slice(0, 200)}`);
@@ -8009,8 +8553,8 @@ var BackupService = class {
     if (result.statusCode < 200 || result.statusCode >= 300) {
       throw new Error(`S3 download failed (HTTP ${result.statusCode}): ${result.body.slice(0, 200)}`);
     }
-    fs33.mkdirSync(path33.dirname(destPath), { recursive: true });
-    fs33.writeFileSync(destPath, Buffer.from(result.body, "binary"));
+    fs34.mkdirSync(path35.dirname(destPath), { recursive: true });
+    fs34.writeFileSync(destPath, Buffer.from(result.body, "binary"));
   }
   /**
    * List backup objects in S3 with the configured prefix.
@@ -8056,10 +8600,10 @@ var BackupService = class {
     if (!entry) {
       throw new Error(`Backup "${backupId}" not found.`);
     }
-    if (!fs33.existsSync(entry.path)) {
+    if (!fs34.existsSync(entry.path)) {
       throw new Error(`Backup file not found at: ${entry.path}`);
     }
-    const encrypted = fs33.readFileSync(entry.path);
+    const encrypted = fs34.readFileSync(entry.path);
     let plaintext;
     try {
       plaintext = decryptBuffer(encrypted, this.key);
@@ -8073,8 +8617,8 @@ var BackupService = class {
     offset += manifestLen;
     const manifest = JSON.parse(manifestStr);
     const restoreBase = targetRepoPath ?? entry.repoPath;
-    const codeIntelDir = path33.join(restoreBase, ".code-intel");
-    fs33.mkdirSync(codeIntelDir, { recursive: true });
+    const codeIntelDir = path35.join(restoreBase, ".code-intel");
+    fs34.mkdirSync(codeIntelDir, { recursive: true });
     for (const fileEntry of manifest.files) {
       const nameLen = plaintext.readUInt16BE(offset);
       offset += 2;
@@ -8091,18 +8635,18 @@ var BackupService = class {
       }
       let destPath;
       if (name === "registry.json" || name === "users.db") {
-        destPath = path33.join(os12.homedir(), ".code-intel", name);
+        destPath = path35.join(os12.homedir(), ".code-intel", name);
       } else {
-        destPath = path33.join(codeIntelDir, name);
+        destPath = path35.join(codeIntelDir, name);
       }
-      fs33.writeFileSync(destPath, data);
+      fs34.writeFileSync(destPath, data);
     }
   }
   /**
    * Apply retention policy: keep N daily, M weekly, L monthly backups.
    */
   applyRetention(options = { daily: 7, weekly: 4, monthly: 12 }) {
-    const entries = this._loadIndex().filter((e) => fs33.existsSync(e.path)).sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+    const entries = this._loadIndex().filter((e) => fs34.existsSync(e.path)).sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
     const keep = /* @__PURE__ */ new Set();
     const now = /* @__PURE__ */ new Date();
     const dailyCutoff = new Date(now);
@@ -8132,7 +8676,7 @@ var BackupService = class {
     for (const e of entries) {
       if (!keep.has(e.id)) {
         try {
-          fs33.unlinkSync(e.path);
+          fs34.unlinkSync(e.path);
           deleted++;
         } catch {
         }
@@ -8144,17 +8688,17 @@ var BackupService = class {
   }
   // ── Index helpers ──────────────────────────────────────────────────────────
   _indexPath() {
-    return path33.join(this.backupDir, "index.json");
+    return path35.join(this.backupDir, "index.json");
   }
   _loadIndex() {
     try {
-      return JSON.parse(fs33.readFileSync(this._indexPath(), "utf-8"));
+      return JSON.parse(fs34.readFileSync(this._indexPath(), "utf-8"));
     } catch {
       return [];
     }
   }
   _saveIndex(entries) {
-    fs33.writeFileSync(this._indexPath(), JSON.stringify(entries, null, 2));
+    fs34.writeFileSync(this._indexPath(), JSON.stringify(entries, null, 2));
   }
   _appendIndex(entry) {
     const entries = this._loadIndex();
@@ -8795,11 +9339,11 @@ var openApiSpec = {
 };
 
 // src/http/app.ts
-var __dirname$1 = path33.dirname(fileURLToPath(import.meta.url));
+var __dirname$1 = path35.dirname(fileURLToPath(import.meta.url));
 var WEB_DIST = (() => {
-  const bundled = path33.resolve(__dirname$1, "..", "web");
-  if (fs33.existsSync(bundled)) return bundled;
-  return path33.resolve(__dirname$1, "..", "..", "..", "web", "dist");
+  const bundled = path35.resolve(__dirname$1, "..", "web");
+  if (fs34.existsSync(bundled)) return bundled;
+  return path35.resolve(__dirname$1, "..", "..", "..", "web", "dist");
 })();
 function getAllowedOrigins() {
   const env = process.env["CODE_INTEL_CORS_ORIGINS"];
@@ -9330,8 +9874,8 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     const registry = loadRegistry();
     const entry = registry.find((r) => r.name === requestedRepo || r.path === requestedRepo);
     if (!entry) return null;
-    const dbPath = path33.join(entry.path, ".code-intel", "graph.db");
-    if (!fs33.existsSync(dbPath)) return null;
+    const dbPath = path35.join(entry.path, ".code-intel", "graph.db");
+    if (!fs34.existsSync(dbPath)) return null;
     const repoGraph = createKnowledgeGraph();
     const db = new DbManager(dbPath);
     try {
@@ -9418,7 +9962,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       return;
     }
     try {
-      const content = fs33.readFileSync(file_path, "utf-8");
+      const content = fs34.readFileSync(file_path, "utf-8");
       res.json({ content });
     } catch {
       res.status(404).json({ error: { code: ErrorCodes.NOT_FOUND, message: "File not found" } });
@@ -9676,8 +10220,8 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     for (const member of group.members) {
       const regEntry = registry.find((r) => r.name === member.registryName);
       if (!regEntry) continue;
-      const dbPath = path33.join(regEntry.path, ".code-intel", "graph.db");
-      if (!fs33.existsSync(dbPath)) continue;
+      const dbPath = path35.join(regEntry.path, ".code-intel", "graph.db");
+      if (!fs34.existsSync(dbPath)) continue;
       const db = new DbManager(dbPath);
       try {
         await db.init();
@@ -9703,8 +10247,8 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       let nodeCount = 0;
       let edgeCount = 0;
       if (regEntry) {
-        const dbPath = path33.join(regEntry.path, ".code-intel", "graph.db");
-        if (fs33.existsSync(dbPath)) {
+        const dbPath = path35.join(regEntry.path, ".code-intel", "graph.db");
+        if (fs34.existsSync(dbPath)) {
           try {
             const db = new DbManager(dbPath);
             await db.init();
@@ -9753,14 +10297,14 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       });
       return;
     }
-    let rawResolved = path33.normalize(file);
-    if (!path33.isAbsolute(rawResolved) && workspaceRoot) {
-      rawResolved = path33.join(workspaceRoot, rawResolved);
+    let rawResolved = path35.normalize(file);
+    if (!path35.isAbsolute(rawResolved) && workspaceRoot) {
+      rawResolved = path35.join(workspaceRoot, rawResolved);
     }
-    const resolvedFile = path33.resolve(rawResolved);
+    const resolvedFile = path35.resolve(rawResolved);
     function isInsideDir(fileAbs, dir) {
-      const rel = path33.relative(path33.resolve(dir), fileAbs);
-      return !rel.startsWith("..") && !path33.isAbsolute(rel);
+      const rel = path35.relative(path35.resolve(dir), fileAbs);
+      return !rel.startsWith("..") && !path35.isAbsolute(rel);
     }
     if (workspaceRoot) {
       if (!isInsideDir(resolvedFile, workspaceRoot)) {
@@ -9797,7 +10341,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     }
     let fileContent;
     try {
-      fileContent = fs33.readFileSync(resolvedFile, "utf-8");
+      fileContent = fs34.readFileSync(resolvedFile, "utf-8");
     } catch {
       res.status(404).json({
         error: {
@@ -9828,7 +10372,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     const contextStart = Math.max(1, startLine - 20);
     const contextEnd = Math.min(lines.length, endLine + 20);
     const content = lines.slice(contextStart - 1, contextEnd).join("\n");
-    const ext = path33.extname(resolvedFile).toLowerCase();
+    const ext = path35.extname(resolvedFile).toLowerCase();
     const languageMap = {
       ".ts": "typescript",
       ".tsx": "typescript",
@@ -9963,10 +10507,10 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       res.status(500).json({ error: { code: ErrorCodes.INTERNAL_ERROR, message: err instanceof Error ? err.message : String(err), requestId: req.requestId, timestamp: (/* @__PURE__ */ new Date()).toISOString() } });
     }
   });
-  if (fs33.existsSync(WEB_DIST)) {
+  if (fs34.existsSync(WEB_DIST)) {
     app.use(express.static(WEB_DIST));
     app.get("/{*path}", (_req, res) => {
-      res.sendFile(path33.join(WEB_DIST, "index.html"));
+      res.sendFile(path35.join(WEB_DIST, "index.html"));
     });
   }
   app.use("/admin", requireRole("admin"));
@@ -10495,22 +11039,22 @@ function suggestTests(graph, symbolName) {
   const callPaths = [];
   const pathQueue = [{ id: targetId, path: [symbolName], depth: 0 }];
   while (pathQueue.length > 0 && callPaths.length < 5) {
-    const { id, path: path34, depth } = pathQueue.shift();
-    let hasCallers = false;
+    const { id, path: path36, depth } = pathQueue.shift();
+    let hasCallers2 = false;
     for (const edge of graph.findEdgesTo(id)) {
       if (edge.kind !== "calls") continue;
       const callerNode = graph.getNode(edge.source);
       if (!callerNode) continue;
-      hasCallers = true;
-      const newPath = [callerNode.name, ...path34];
+      hasCallers2 = true;
+      const newPath = [callerNode.name, ...path36];
       if (depth + 1 >= 3 || callPaths.length >= 5) {
         if (callPaths.length < 5) callPaths.push(newPath);
         continue;
       }
       pathQueue.push({ id: edge.source, path: newPath, depth: depth + 1 });
     }
-    if (!hasCallers && path34.length > 1) {
-      callPaths.push(path34);
+    if (!hasCallers2 && path36.length > 1) {
+      callPaths.push(path36);
     }
   }
   if (callPaths.length === 0) {
@@ -10985,6 +11529,70 @@ function createMcpServer(graph, repoName, workspaceRoot) {
           },
           required: ["cluster"]
         }
+      },
+      {
+        name: "deprecated_usage",
+        description: "Find usages of deprecated APIs in the codebase",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Directory scope filter" },
+            ..._tokenProp
+          }
+        }
+      },
+      {
+        name: "complexity_hotspots",
+        description: "Ranked list of functions/methods by cyclomatic complexity. Useful for identifying refactoring candidates.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Limit to a file path prefix (optional)" },
+            limit: { type: "number", description: "Maximum number of results (default: 20)" },
+            ..._tokenProp
+          }
+        }
+      },
+      {
+        name: "coverage_gaps",
+        description: "Find exported symbols with no test coverage, ranked by blast radius. Useful for prioritizing test writing.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Limit to a file path prefix (optional)" },
+            limit: { type: "number", description: "Maximum number of untested results to return (default: 20)" },
+            ..._tokenProp
+          }
+        }
+      },
+      {
+        name: "secrets",
+        description: "Scan the knowledge graph for hardcoded secrets: API keys, passwords, tokens, private keys, high-entropy strings",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Limit scan to files under this path prefix" },
+            includeTestFiles: { type: "boolean", description: "Include test/spec/fixture files (default: false)" },
+            ..._tokenProp
+          }
+        }
+      },
+      {
+        name: "vulnerability_scan",
+        description: "Scan the knowledge graph for OWASP vulnerabilities: SQL injection, XSS, SSRF, path traversal, command injection",
+        inputSchema: {
+          type: "object",
+          properties: {
+            scope: { type: "string", description: "Limit scan to files under this path prefix" },
+            types: {
+              type: "array",
+              items: { type: "string", enum: ["SQL_INJECTION", "XSS", "SSRF", "PATH_TRAVERSAL", "COMMAND_INJECTION"] },
+              description: "Vulnerability types to detect (default: all)"
+            },
+            severity: { type: "string", description: "Minimum severity to report: HIGH|MEDIUM|LOW (default: LOW)" },
+            ..._tokenProp
+          }
+        }
       }
     ]
   }));
@@ -11408,7 +12016,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       for (const { filePath: changedFile, changedLines } of changedFiles) {
         for (const node of graph.allNodes()) {
           if (!node.filePath) continue;
-          const normNode = node.filePath.replace(repoRoot + "/", "").replace(repoRoot + path33.sep, "");
+          const normNode = node.filePath.replace(repoRoot + "/", "").replace(repoRoot + path35.sep, "");
           const normChanged = changedFile.replace(/^a\/|^b\//, "");
           if (!normNode.endsWith(normChanged) && !normChanged.endsWith(normNode)) continue;
           if (node.startLine !== void 0 && node.endLine !== void 0) {
@@ -11681,6 +12289,63 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       const result = summarizeCluster(graph, cluster);
       return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
     }
+    case "deprecated_usage": {
+      const scope = a.scope;
+      const { DeprecatedDetector: DeprecatedDetector2 } = await Promise.resolve().then(() => (init_deprecated_detector(), deprecated_detector_exports));
+      const detector = new DeprecatedDetector2();
+      detector.tagDeprecated(graph);
+      const findings = detector.detect(graph, scope);
+      return { content: [{ type: "text", text: JSON.stringify({ findings, total: findings.length }, null, 2) }] };
+    }
+    // ── complexity_hotspots ────────────────────────────────────────────────
+    case "complexity_hotspots": {
+      const { computeComplexity: computeComplexity2 } = await Promise.resolve().then(() => (init_complexity(), complexity_exports));
+      const scope = a.scope;
+      const limit = typeof a.limit === "number" ? a.limit : 20;
+      const hotspots = computeComplexity2(graph, scope).slice(0, limit);
+      return { content: [{ type: "text", text: JSON.stringify({ hotspots, total: hotspots.length }, null, 2) }] };
+    }
+    // ── coverage_gaps ──────────────────────────────────────────────────────
+    case "coverage_gaps": {
+      const { computeCoverage: computeCoverage2 } = await Promise.resolve().then(() => (init_test_coverage(), test_coverage_exports));
+      const scope = a.scope;
+      const limit = typeof a.limit === "number" ? a.limit : 20;
+      const summary = computeCoverage2(graph, scope);
+      const untestedByRisk = summary.untestedByRisk.slice(0, limit);
+      return {
+        content: [{
+          type: "text",
+          text: JSON.stringify({
+            untestedByRisk,
+            coveragePct: summary.coveragePct,
+            totalExported: summary.totalExported,
+            testedExported: summary.testedExported
+          }, null, 2)
+        }]
+      };
+    }
+    // ── secrets ────────────────────────────────────────────────────────────
+    case "secrets": {
+      const { SecretScanner: SecretScanner2 } = await Promise.resolve().then(() => (init_secret_scanner(), secret_scanner_exports));
+      const scanner = new SecretScanner2();
+      const scope = a.scope;
+      const includeTestFiles = a.includeTestFiles ?? false;
+      const findings = scanner.scan(graph, { scope, includeTestFiles });
+      return { content: [{ type: "text", text: JSON.stringify({ findings, total: findings.length }, null, 2) }] };
+    }
+    // ── vulnerability_scan ─────────────────────────────────────────────────
+    case "vulnerability_scan": {
+      const { VulnerabilityDetector: VulnerabilityDetector2 } = await Promise.resolve().then(() => (init_vulnerability_detector(), vulnerability_detector_exports));
+      const detector = new VulnerabilityDetector2();
+      const scope = a.scope;
+      const types = a.types;
+      const minSev = (a.severity ?? "LOW").toUpperCase();
+      const sevRank = { HIGH: 3, MEDIUM: 2, LOW: 1 };
+      const minRank = sevRank[minSev] ?? 1;
+      let findings = detector.detect(graph, { scope, types });
+      findings = findings.filter((f) => (sevRank[f.severity] ?? 1) >= minRank);
+      return { content: [{ type: "text", text: JSON.stringify({ findings, total: findings.length }, null, 2) }] };
+    }
     default:
       return { content: [{ type: "text", text: `Unknown tool: ${name}` }] };
   }
@@ -11767,20 +12432,20 @@ function parseDiff(diffText) {
 // src/cli/main.ts
 init_metadata();
 async function writeSkillFiles(graph, workspaceRoot, projectName) {
-  const outputDir = path33.join(workspaceRoot, ".claude", "skills", "code-intel");
+  const outputDir = path35.join(workspaceRoot, ".claude", "skills", "code-intel");
   const areas = buildAreaMap(graph, workspaceRoot);
   if (areas.length === 0) return { skills: [], outputDir };
-  fs33.rmSync(outputDir, { recursive: true, force: true });
-  fs33.mkdirSync(outputDir, { recursive: true });
+  fs34.rmSync(outputDir, { recursive: true, force: true });
+  fs34.mkdirSync(outputDir, { recursive: true });
   const skills = [];
   const usedNames = /* @__PURE__ */ new Set();
   for (const area of areas) {
     const kebab = uniqueKebab(area.label, usedNames);
     usedNames.add(kebab);
     const content = renderSkill(area, projectName, kebab);
-    const dir = path33.join(outputDir, kebab);
-    fs33.mkdirSync(dir, { recursive: true });
-    fs33.writeFileSync(path33.join(dir, "SKILL.md"), content, "utf-8");
+    const dir = path35.join(outputDir, kebab);
+    fs34.mkdirSync(dir, { recursive: true });
+    fs34.writeFileSync(path35.join(dir, "SKILL.md"), content, "utf-8");
     skills.push({ name: kebab, label: area.label, symbolCount: area.nodes.length, fileCount: area.files.size });
   }
   return { skills, outputDir };
@@ -11960,11 +12625,20 @@ var BLOCK_START = "<!-- code-intel:start -->";
 var BLOCK_END = "<!-- code-intel:end -->";
 function writeContextFiles(workspaceRoot, projectName, stats, skills) {
   const block = buildBlock(projectName, stats, skills);
-  upsertFile(path33.join(workspaceRoot, "AGENTS.md"), block, "AGENTS.md");
-  upsertFile(path33.join(workspaceRoot, "CLAUDE.md"), block, "CLAUDE.md");
+  upsertFile(path35.join(workspaceRoot, "AGENTS.md"), block, "AGENTS.md");
+  upsertFile(path35.join(workspaceRoot, "CLAUDE.md"), block, "CLAUDE.md");
+  const githubDir = path35.join(workspaceRoot, ".github");
+  if (!fs34.existsSync(githubDir)) fs34.mkdirSync(githubDir, { recursive: true });
+  upsertFile(path35.join(githubDir, "copilot-instructions.md"), block, "copilot-instructions.md");
+  const cursorDir = path35.join(workspaceRoot, ".cursor", "rules");
+  if (!fs34.existsSync(cursorDir)) fs34.mkdirSync(cursorDir, { recursive: true });
+  upsertFile(path35.join(cursorDir, "code-intel.mdc"), block, "code-intel.mdc");
+  const kiroDir = path35.join(workspaceRoot, ".kiro", "steering");
+  if (!fs34.existsSync(kiroDir)) fs34.mkdirSync(kiroDir, { recursive: true });
+  upsertFile(path35.join(kiroDir, "code-intel.md"), block, "code-intel.md");
 }
 function buildBlock(projectName, stats, skills) {
-  const skillRows = skills.map(
+  const skillTableRows = skills.map(
     (s) => `| Work in \`${s.label}\` (${s.symbolCount} symbols) | \`.claude/skills/code-intel/${s.name}/SKILL.md\` |`
   ).join("\n");
   const skillTable = `| Task | Skill file |
@@ -11972,7 +12646,15 @@ function buildBlock(projectName, stats, skills) {
 | Understand architecture / "How does X work?" | Load \`code-intel-exploring\` skill |
 | Blast radius / "What breaks if I change X?" | Load \`code-intel-impact\` skill |
 | Debugging / "Why is X failing?" | Load \`code-intel-debugging\` skill |
-${skillRows ? skillRows + "\n" : ""}`;
+${skillTableRows ? skillTableRows + "\n" : ""}`;
+  const skillLoadInstructions = skills.length > 0 ? `
+## When to Load a Skill
+
+Before working deeply in a subsystem, **load the matching skill file** listed above.
+Each skill gives you symbol maps, key entry points, and safe-change guidance for that area.
+
+${skills.map((s) => `- Working in **${s.label}**? \u2192 Load \`.claude/skills/code-intel/${s.name}/SKILL.md\``).join("\n")}
+` : "";
   return `${BLOCK_START}
 # Code Intelligence \u2014 ${projectName}
 
@@ -11983,39 +12665,114 @@ Indexed: **${stats.nodes.toLocaleString()} nodes** | **${stats.edges.toLocaleStr
 
 > Index stale? Re-run: \`code-intel analyze\`
 
-## Always Do
+## Mandatory Rules \u2014 ALL Agents (Amp, Claude Code, Codex, Copilot, Cursor, Aider, Gemini, Kiro, Trae, Hermes, Factory, OpenCode, Pi, Antigravity, OpenClaw, and others)
 
-- **Before editing any symbol**, run \`code-intel impact <symbol>\` to review its blast radius.
-- **Before committing**, verify scope with \`code-intel inspect <symbol>\`.
-- Use \`code-intel search "<concept>"\` to find related symbols instead of grepping.
-- Warn the user if impact shows \u2265 5 direct callers (**HIGH risk**).
+These rules apply to **every coding agent or AI assistant** working in this repository.
 
-## Never Do
+### Before Implementing Any Change
+1. Run \`code-intel search "<concept>"\` \u2014 find existing symbols related to the task.
+2. Run \`code-intel inspect <symbol>\` \u2014 understand callers, callees, and imports.
+3. Run \`code-intel impact <symbol>\` \u2014 check blast radius before touching anything.
+4. **If impact shows \u2265 5 direct callers \u2192 warn the user: HIGH risk.**
 
-- NEVER rename symbols with find-and-replace \u2014 use \`code-intel inspect\` to find all usages first.
-- NEVER ignore impact warnings \u2014 always report blast radius to the user.
+### While Implementing / Fixing a Bug
 - NEVER open a file cold \u2014 always \`code-intel search\` first.
 - NEVER grep for symbols \u2014 use \`code-intel search\` instead.
+- NEVER rename symbols with find-and-replace \u2014 use \`code-intel inspect\` to find all usages first.
+- Use \`code-intel inspect <symbol>\` to understand a function's callers/callees before modifying it.
+- Use \`code-intel query "TRAVERSE CALLS FROM '<symbol>' DEPTH 3"\` to trace execution paths.
+
+### Before Committing / Code Review
+- Run \`code-intel impact <symbol>\` for every symbol you changed.
+- Run \`code-intel pr-impact --base main --head HEAD\` to see full PR blast radius.
+- Fail PR if HIGH risk symbols are changed without reviewer sign-off.
+
+### Studying the Codebase
+- Use \`code-intel search "<concept>"\` to explore unfamiliar areas.
+- Use \`code-intel inspect <symbol>\` to see a symbol's full context.
+- Use \`code-intel serve\` to open the interactive Web UI for graph exploration.
+- Use subsystem skills (see table below) for deep-dive on a specific area.
+
+## Never Do
+
+- NEVER ignore impact warnings \u2014 always report blast radius to the user.
+- NEVER skip \`code-intel search\` before grepping or opening files.
+- NEVER make changes to a symbol with \u2265 5 callers without running \`code-intel impact\` first.
+- NEVER use find-and-replace for symbol renames.
+
+## Development Workflow
+
+### \u{1F527} Implement a New Feature
+\`\`\`
+1. code-intel search "<feature concept>"      # find related existing symbols
+2. code-intel inspect <related-symbol>        # understand context & callers
+3. Load subsystem skill (see Skills table)    # deep-dive the area
+4. Implement changes
+5. code-intel impact <changed-symbol>         # verify blast radius
+6. code-intel pr-impact --base main           # full PR summary before commit
+\`\`\`
+
+### \u{1F41B} Fix a Bug
+\`\`\`
+1. code-intel search "<buggy behavior>"                              # locate the symbol
+2. code-intel query "TRAVERSE CALLS FROM '<symbol>' DEPTH 3"        # trace execution path
+3. code-intel inspect <symbol>                                       # find all callers that may be affected
+4. Fix the bug
+5. code-intel impact <symbol>                                        # confirm no unexpected side effects
+\`\`\`
+
+### \u{1F52C} Study / Understand Code
+\`\`\`
+1. code-intel search "<concept>"                                     # discover entry points
+2. code-intel inspect <symbol>                                       # full context: callers, callees, imports
+3. code-intel query "TRAVERSE CALLS FROM '<symbol>' DEPTH 3"        # execution call graph
+4. code-intel query "PATH FROM '<symbol>' TO '<target>'"            # path between two symbols
+5. Load subsystem skill                                              # structured deep-dive
+\`\`\`
+
+### \u{1F440} Code Review
+\`\`\`
+1. code-intel pr-impact --base main --head HEAD   # blast radius of all PR changes
+2. code-intel impact <each-changed-symbol>         # per-symbol risk check
+3. Flag HIGH risk (\u2265 5 callers) for reviewer sign-off
+\`\`\`
+
+### \u{1F504} Maintain / Refactor
+\`\`\`
+1. code-intel inspect <symbol>                # find ALL usages before touching
+2. code-intel impact <symbol>                 # blast radius \u2014 plan your changes
+3. Make changes incrementally
+4. code-intel pr-impact --base main           # validate scope hasn't exploded
+\`\`\`
 
 ## CLI Quick Reference
 
 \`\`\`bash
-code-intel analyze [path]          # Build / refresh the knowledge graph
-code-intel serve [path]            # Start HTTP API + Web UI on :4747
-code-intel search <query>          # Text search across all symbols
-code-intel inspect <symbol>        # Callers, callees, imports, cluster
-code-intel impact <symbol>         # Blast radius (who breaks if this changes)
-code-intel status [path]           # Index freshness and stats
-code-intel clean [path]            # Remove index data
+code-intel analyze [path]                                      # Build / refresh the knowledge graph
+code-intel serve [path]                                        # Start HTTP API + Web UI on :4747
+code-intel search <query>                                      # Find symbols by concept/name
+code-intel inspect <symbol>                                    # Callers, callees, imports, cluster
+code-intel impact <symbol>                                     # Blast radius (who breaks if this changes)
+code-intel query "TRAVERSE CALLS FROM '<symbol>' DEPTH 3"     # Trace execution call graph
+code-intel query "PATH FROM '<sym>' TO '<target>'"             # Find path between two symbols
+code-intel query "FIND function WHERE name CONTAINS '<x>'"    # GQL symbol search
+code-intel pr-impact --base main --head HEAD                   # Full PR blast radius report
+code-intel complexity [path] --top 10                         # Cyclomatic complexity hotspots
+code-intel coverage [path]                                     # Untested exported symbols by blast radius
+code-intel secrets [path]                                      # Scan for hardcoded secrets
+code-intel scan [path] --severity high                         # OWASP vulnerability scan
+code-intel deprecated [path]                                   # Find deprecated API usages
+code-intel status [path]                                       # Index freshness and stats
+code-intel clean [path]                                        # Remove index data
 \`\`\`
 
 ## Skills
-
+${skillLoadInstructions}
 ${skillTable}
 ${BLOCK_END}`;
 }
 function upsertFile(filePath, block, fileName) {
-  if (!fs33.existsSync(filePath)) {
+  if (!fs34.existsSync(filePath)) {
     const newContent = [
       `# ${fileName}`,
       "",
@@ -12026,17 +12783,17 @@ function upsertFile(filePath, block, fileName) {
       "<!-- Add your own custom notes below this line. They will never be overwritten by code-intel. -->",
       ""
     ].join("\n");
-    fs33.writeFileSync(filePath, newContent, "utf-8");
+    fs34.writeFileSync(filePath, newContent, "utf-8");
     return;
   }
-  const existing = fs33.readFileSync(filePath, "utf-8");
+  const existing = fs34.readFileSync(filePath, "utf-8");
   const startIdx = findLineMarker(existing, BLOCK_START);
   const endIdx = findLineMarker(existing, BLOCK_END, startIdx === -1 ? 0 : startIdx);
   if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
     const before = existing.slice(0, startIdx);
     const after = existing.slice(endIdx + BLOCK_END.length);
     const updated = (before + block + after).trimEnd() + "\n";
-    fs33.writeFileSync(filePath, updated, "utf-8");
+    fs34.writeFileSync(filePath, updated, "utf-8");
     return;
   }
   const appended = [
@@ -12049,7 +12806,7 @@ function upsertFile(filePath, block, fileName) {
     block,
     ""
   ].join("\n");
-  fs33.writeFileSync(filePath, appended, "utf-8");
+  fs34.writeFileSync(filePath, appended, "utf-8");
 }
 function findLineMarker(content, marker, startFrom = 0) {
   let idx = content.indexOf(marker, startFrom);
@@ -12091,14 +12848,14 @@ function getChangedFilesSince(workspaceRoot, baseHash) {
 function filterChangedByMtime(allFilePaths, workspaceRoot, storedMtimes) {
   const changed = [];
   for (const absPath of allFilePaths) {
-    const rel = path33.relative(workspaceRoot, absPath);
+    const rel = path35.relative(workspaceRoot, absPath);
     const stored = storedMtimes[rel];
     if (stored === void 0) {
       changed.push(absPath);
       continue;
     }
     try {
-      const { mtimeMs } = fs33.statSync(absPath);
+      const { mtimeMs } = fs34.statSync(absPath);
       if (mtimeMs > stored) changed.push(absPath);
     } catch {
       changed.push(absPath);
@@ -12110,8 +12867,8 @@ function buildMtimeSnapshot(filePaths, workspaceRoot) {
   const snap = {};
   for (const absPath of filePaths) {
     try {
-      const { mtimeMs } = fs33.statSync(absPath);
-      snap[path33.relative(workspaceRoot, absPath)] = mtimeMs;
+      const { mtimeMs } = fs34.statSync(absPath);
+      snap[path35.relative(workspaceRoot, absPath)] = mtimeMs;
     } catch {
     }
   }
@@ -12122,8 +12879,8 @@ function decideIncremental(workspaceRoot, allFilePaths, prevCommitHash, storedMt
   if (prevCommitHash) {
     const changed = getChangedFilesSince(workspaceRoot, prevCommitHash);
     if (changed !== null) {
-      const scanSet = new Set(allFilePaths.map((p) => path33.relative(workspaceRoot, p)));
-      const changedInScan = changed.filter((rel) => scanSet.has(rel)).map((rel) => path33.join(workspaceRoot, rel));
+      const scanSet = new Set(allFilePaths.map((p) => path35.relative(workspaceRoot, p)));
+      const changedInScan = changed.filter((rel) => scanSet.has(rel)).map((rel) => path35.join(workspaceRoot, rel));
       if (total > 0 && changedInScan.length / total > 0.2) {
         return { incremental: false, fallbackReason: `changed files (${changedInScan.length}) > 20% of total (${total})` };
       }
@@ -12150,11 +12907,11 @@ init_group_sync();
 function expandGlob(root, pattern) {
   const parts = pattern.replace(/\/\*\*?$/, "").split("/").filter(Boolean);
   if (parts.length === 0) return [];
-  const dir = path33.join(root, ...parts);
-  if (!fs33.existsSync(dir)) return [];
-  return fs33.readdirSync(dir).map((entry) => path33.join(dir, entry)).filter((p) => {
+  const dir = path35.join(root, ...parts);
+  if (!fs34.existsSync(dir)) return [];
+  return fs34.readdirSync(dir).map((entry) => path35.join(dir, entry)).filter((p) => {
     try {
-      return fs33.statSync(p).isDirectory();
+      return fs34.statSync(p).isDirectory();
     } catch {
       return false;
     }
@@ -12165,11 +12922,11 @@ function resolvePackages(root, patterns) {
   for (const pattern of patterns) {
     const dirs = expandGlob(root, pattern);
     for (const dir of dirs) {
-      const pkgJsonPath = path33.join(dir, "package.json");
-      if (!fs33.existsSync(pkgJsonPath)) continue;
+      const pkgJsonPath = path35.join(dir, "package.json");
+      if (!fs34.existsSync(pkgJsonPath)) continue;
       try {
-        const pkgJson = JSON.parse(fs33.readFileSync(pkgJsonPath, "utf-8"));
-        const name = pkgJson.name ?? path33.basename(dir);
+        const pkgJson = JSON.parse(fs34.readFileSync(pkgJsonPath, "utf-8"));
+        const name = pkgJson.name ?? path35.basename(dir);
         packages.push({ name, path: dir });
       } catch {
       }
@@ -12178,13 +12935,13 @@ function resolvePackages(root, patterns) {
   return packages;
 }
 async function detectWorkspace(root) {
-  const turboJsonPath = path33.join(root, "turbo.json");
-  if (fs33.existsSync(turboJsonPath)) {
+  const turboJsonPath = path35.join(root, "turbo.json");
+  if (fs34.existsSync(turboJsonPath)) {
     let patterns = [];
-    const pkgJsonPath = path33.join(root, "package.json");
-    if (fs33.existsSync(pkgJsonPath)) {
+    const pkgJsonPath = path35.join(root, "package.json");
+    if (fs34.existsSync(pkgJsonPath)) {
       try {
-        const pkgJson = JSON.parse(fs33.readFileSync(pkgJsonPath, "utf-8"));
+        const pkgJson = JSON.parse(fs34.readFileSync(pkgJsonPath, "utf-8"));
         if (pkgJson.workspaces) {
           patterns = Array.isArray(pkgJson.workspaces) ? pkgJson.workspaces : pkgJson.workspaces.packages;
         }
@@ -12192,16 +12949,16 @@ async function detectWorkspace(root) {
       }
     }
     if (patterns.length === 0) {
-      const fallbackDir = path33.join(root, "packages");
-      if (fs33.existsSync(fallbackDir)) patterns = ["packages/*"];
+      const fallbackDir = path35.join(root, "packages");
+      if (fs34.existsSync(fallbackDir)) patterns = ["packages/*"];
     }
     const packages = resolvePackages(root, patterns);
     return { type: "turborepo", root, packages };
   }
-  const npmPkgJsonPath = path33.join(root, "package.json");
-  if (fs33.existsSync(npmPkgJsonPath)) {
+  const npmPkgJsonPath = path35.join(root, "package.json");
+  if (fs34.existsSync(npmPkgJsonPath)) {
     try {
-      const pkgJson = JSON.parse(fs33.readFileSync(npmPkgJsonPath, "utf-8"));
+      const pkgJson = JSON.parse(fs34.readFileSync(npmPkgJsonPath, "utf-8"));
       if (pkgJson.workspaces) {
         const patterns = Array.isArray(pkgJson.workspaces) ? pkgJson.workspaces : pkgJson.workspaces.packages;
         const packages = resolvePackages(root, patterns);
@@ -12210,11 +12967,11 @@ async function detectWorkspace(root) {
     } catch {
     }
   }
-  const pnpmYamlPath = path33.join(root, "pnpm-workspace.yaml");
-  if (fs33.existsSync(pnpmYamlPath)) {
+  const pnpmYamlPath = path35.join(root, "pnpm-workspace.yaml");
+  if (fs34.existsSync(pnpmYamlPath)) {
     const patterns = [];
     try {
-      const content = fs33.readFileSync(pnpmYamlPath, "utf-8");
+      const content = fs34.readFileSync(pnpmYamlPath, "utf-8");
       let inPackages = false;
       for (const line of content.split("\n")) {
         if (/^packages\s*:/.test(line)) {
@@ -12234,30 +12991,30 @@ async function detectWorkspace(root) {
     const packages = resolvePackages(root, patterns);
     return { type: "pnpm", root, packages };
   }
-  const nxJsonPath = path33.join(root, "nx.json");
-  if (fs33.existsSync(nxJsonPath)) {
+  const nxJsonPath = path35.join(root, "nx.json");
+  if (fs34.existsSync(nxJsonPath)) {
     const packages = [];
     const scanForProjects = (dir, depth) => {
       if (depth > 2) return;
       let entries;
       try {
-        entries = fs33.readdirSync(dir);
+        entries = fs34.readdirSync(dir);
       } catch {
         return;
       }
       for (const entry of entries) {
         if (entry === "node_modules" || entry.startsWith(".")) continue;
-        const fullPath = path33.join(dir, entry);
+        const fullPath = path35.join(dir, entry);
         try {
-          if (!fs33.statSync(fullPath).isDirectory()) continue;
+          if (!fs34.statSync(fullPath).isDirectory()) continue;
         } catch {
           continue;
         }
-        const projectJsonPath = path33.join(fullPath, "project.json");
-        if (fs33.existsSync(projectJsonPath)) {
+        const projectJsonPath = path35.join(fullPath, "project.json");
+        if (fs34.existsSync(projectJsonPath)) {
           try {
-            const proj = JSON.parse(fs33.readFileSync(projectJsonPath, "utf-8"));
-            const name = proj.name ?? path33.basename(fullPath);
+            const proj = JSON.parse(fs34.readFileSync(projectJsonPath, "utf-8"));
+            const name = proj.name ?? path35.basename(fullPath);
             packages.push({ name, path: fullPath });
           } catch {
           }
@@ -12365,17 +13122,17 @@ var MigrationRunner = class {
   autoBackupBeforeMigration() {
     try {
       const dbFile = this.db.name;
-      if (!dbFile || !fs33.existsSync(dbFile)) return;
-      const backupDir = path33.join(os12.homedir(), ".code-intel", "backups", "pre-migration");
-      fs33.mkdirSync(backupDir, { recursive: true });
+      if (!dbFile || !fs34.existsSync(dbFile)) return;
+      const backupDir = path35.join(os12.homedir(), ".code-intel", "backups", "pre-migration");
+      fs34.mkdirSync(backupDir, { recursive: true });
       const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
-      const baseName = path33.basename(dbFile, ".db");
-      const backupPath = path33.join(backupDir, `${baseName}-pre-migration-${ts}.db`);
+      const baseName = path35.basename(dbFile, ".db");
+      const backupPath = path35.join(backupDir, `${baseName}-pre-migration-${ts}.db`);
       try {
         this.db.pragma("wal_checkpoint(TRUNCATE)");
       } catch {
       }
-      fs33.copyFileSync(dbFile, backupPath);
+      fs34.copyFileSync(dbFile, backupPath);
     } catch {
     }
   }
@@ -12591,7 +13348,7 @@ program.name("code-intel").description("Code Intelligence Platform \u2014 Static
   Docs: https://github.com/vohongtho/code-intel-platform
 `);
 async function analyzeWorkspace(targetPath, options) {
-  const workspaceRoot = path33.resolve(targetPath);
+  const workspaceRoot = path35.resolve(targetPath);
   if (!options?.silent) console.log(`Analyzing: ${workspaceRoot}`);
   logger_default.info(`analyze started: ${workspaceRoot}`);
   if (options?.force) {
@@ -12612,14 +13369,14 @@ async function analyzeWorkspace(targetPath, options) {
     ];
     for (const f of wipeFiles) {
       try {
-        if (fs33.existsSync(f)) fs33.unlinkSync(f);
+        if (fs34.existsSync(f)) fs34.unlinkSync(f);
       } catch {
       }
     }
   }
   if (!options?.skipGit) {
-    const gitDir = path33.join(workspaceRoot, ".git");
-    if (!fs33.existsSync(gitDir)) {
+    const gitDir = path35.join(workspaceRoot, ".git");
+    if (!fs34.existsSync(gitDir)) {
       logger_default.warn(`${workspaceRoot} is not a Git repository`);
     }
   }
@@ -12730,17 +13487,17 @@ async function analyzeWorkspace(targetPath, options) {
   const result = await runPipeline(phases, context2);
   if (isIncremental && incrementalChangedFiles && incrementalChangedFiles.length > 0) {
     const dbPath = getDbPath(workspaceRoot);
-    if (fs33.existsSync(dbPath)) {
+    if (fs34.existsSync(dbPath)) {
       try {
         const db = new DbManager(dbPath);
         await db.init();
         for (const absPath of incrementalChangedFiles) {
-          const rel = path33.relative(workspaceRoot, absPath);
+          const rel = path35.relative(workspaceRoot, absPath);
           await removeNodesForFile(rel, db);
         }
         const { upsertNodes: upsertNodesBatch } = await Promise.resolve().then(() => (init_graph_loader(), graph_loader_exports));
         const changedRelPaths = new Set(
-          incrementalChangedFiles.map((f) => path33.relative(workspaceRoot, f))
+          incrementalChangedFiles.map((f) => path35.relative(workspaceRoot, f))
         );
         const nodesToUpsert = [...graph.allNodes()].filter(
           (n) => changedRelPaths.has(n.filePath)
@@ -12765,7 +13522,7 @@ async function analyzeWorkspace(targetPath, options) {
     mergedMtimes = newMtimes;
   }
   const currentCommitHash = getCurrentCommitHash(workspaceRoot) ?? void 0;
-  const repoName = path33.basename(workspaceRoot);
+  const repoName = path35.basename(workspaceRoot);
   const indexVersion = v4();
   saveMetadata(workspaceRoot, {
     indexedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -12803,7 +13560,7 @@ async function analyzeWorkspace(targetPath, options) {
     ];
     for (const f of newStaleFiles) {
       try {
-        if (fs33.existsSync(f)) fs33.unlinkSync(f);
+        if (fs34.existsSync(f)) fs34.unlinkSync(f);
       } catch {
       }
     }
@@ -12820,21 +13577,21 @@ async function analyzeWorkspace(targetPath, options) {
     ];
     for (const f of staleFiles) {
       try {
-        if (fs33.existsSync(f)) fs33.unlinkSync(f);
+        if (fs34.existsSync(f)) fs34.unlinkSync(f);
       } catch {
       }
     }
     for (const f of newStaleFiles) {
       if (f === dbPathNew) continue;
-      if (fs33.existsSync(f)) {
+      if (fs34.existsSync(f)) {
         const dest = f.replace(dbPathNew, dbPath);
         try {
-          fs33.renameSync(f, dest);
+          fs34.renameSync(f, dest);
         } catch {
         }
       }
     }
-    fs33.renameSync(dbPathNew, dbPath);
+    fs34.renameSync(dbPathNew, dbPath);
     stopSpinner();
     logger_default.info(`DB persisted: ${nodeCount} nodes, ${edgeCount} edges`);
     if (!options?.silent) {
@@ -12855,7 +13612,7 @@ async function analyzeWorkspace(targetPath, options) {
       const staleVdb = [vdbPath, `${vdbPath}-shm`, `${vdbPath}-wal`];
       for (const f of staleVdb) {
         try {
-          if (fs33.existsSync(f)) fs33.unlinkSync(f);
+          if (fs34.existsSync(f)) fs34.unlinkSync(f);
         } catch {
         }
       }
@@ -12979,8 +13736,8 @@ program.command("setup").description("Configure MCP server for your editors (one
     const configFile = `${configDir}/claude_desktop_config.json`;
     try {
       let existing = {};
-      if (fs33.existsSync(configFile)) {
-        existing = JSON.parse(fs33.readFileSync(configFile, "utf-8"));
+      if (fs34.existsSync(configFile)) {
+        existing = JSON.parse(fs34.readFileSync(configFile, "utf-8"));
       }
       const merged = {
         ...existing,
@@ -12989,8 +13746,8 @@ program.command("setup").description("Configure MCP server for your editors (one
           ...mcpConfig.mcpServers
         }
       };
-      fs33.mkdirSync(configDir, { recursive: true });
-      fs33.writeFileSync(configFile, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+      fs34.mkdirSync(configDir, { recursive: true });
+      fs34.writeFileSync(configFile, JSON.stringify(merged, null, 2) + "\n", "utf-8");
       console.log(`
   \u2705  Written to ${configFile}`);
     } catch (err) {
@@ -13060,10 +13817,10 @@ program.command("mcp").description("Start MCP server over stdio \u2014 exposes a
     $ code-intel mcp
     $ code-intel mcp ./my-project
 `).action(async (targetPath) => {
-  const workspaceRoot = path33.resolve(targetPath);
-  const repoName = path33.basename(workspaceRoot);
+  const workspaceRoot = path35.resolve(targetPath);
+  const repoName = path35.basename(workspaceRoot);
   const dbPath = getDbPath(workspaceRoot);
-  const existingIndex = fs33.existsSync(dbPath) && loadMetadata(workspaceRoot) !== null;
+  const existingIndex = fs34.existsSync(dbPath) && loadMetadata(workspaceRoot) !== null;
   if (existingIndex) {
     const graph = createKnowledgeGraph();
     const db = new DbManager(dbPath);
@@ -13094,10 +13851,10 @@ program.command("serve").description("Start the local HTTP server + web UI for g
     $ code-intel serve --port 8080
     $ code-intel serve --force
 `).action(async (targetPath, options) => {
-  const workspaceRoot = path33.resolve(targetPath);
-  const repoName = path33.basename(workspaceRoot);
+  const workspaceRoot = path35.resolve(targetPath);
+  const repoName = path35.basename(workspaceRoot);
   const dbPath = getDbPath(workspaceRoot);
-  const existingIndex = !options.force && fs33.existsSync(dbPath) && loadMetadata(workspaceRoot) !== null;
+  const existingIndex = !options.force && fs34.existsSync(dbPath) && loadMetadata(workspaceRoot) !== null;
   if (existingIndex) {
     const meta = loadMetadata(workspaceRoot);
     if (meta.parser === "regex" || meta.parser === void 0) {
@@ -13131,10 +13888,10 @@ program.command("watch").description("Start HTTP server + file watcher (auto-rei
 `).action(async (targetPath, options) => {
   const { FileWatcher: FileWatcher2 } = await Promise.resolve().then(() => (init_file_watcher(), file_watcher_exports));
   const { IncrementalIndexer: IncrementalIndexer2 } = await Promise.resolve().then(() => (init_incremental_indexer(), incremental_indexer_exports));
-  const workspaceRoot = path33.resolve(targetPath);
-  const repoName = path33.basename(workspaceRoot);
+  const workspaceRoot = path35.resolve(targetPath);
+  const repoName = path35.basename(workspaceRoot);
   const dbPath = getDbPath(workspaceRoot);
-  const existingIndex = !options.force && fs33.existsSync(dbPath) && loadMetadata(workspaceRoot) !== null;
+  const existingIndex = !options.force && fs34.existsSync(dbPath) && loadMetadata(workspaceRoot) !== null;
   let graph;
   if (existingIndex) {
     const meta = loadMetadata(workspaceRoot);
@@ -13169,7 +13926,7 @@ program.command("watch").description("Start HTTP server + file watcher (auto-rei
         type: "graph:updated",
         indexVersion: meta?.indexVersion ?? "unknown",
         stats: { nodes: graph.size.nodes, edges: graph.size.edges },
-        changedFiles: changedFiles.map((f) => path33.relative(workspaceRoot, f)),
+        changedFiles: changedFiles.map((f) => path35.relative(workspaceRoot, f)),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
     }
@@ -13220,7 +13977,7 @@ program.command("status").description("Show index freshness and statistics for a
     $ code-intel status
     $ code-intel status ./my-project
 `).action((targetPath) => {
-  const workspaceRoot = path33.resolve(targetPath);
+  const workspaceRoot = path35.resolve(targetPath);
   const meta = loadMetadata(workspaceRoot);
   if (!meta) {
     console.log(`
@@ -13244,18 +14001,18 @@ function trashDirName(repoPath) {
   return `.code-intel-trash-${date}`;
 }
 function softDeleteCodeIntel(repoPath) {
-  const codeIntelDir = path33.join(repoPath, ".code-intel");
-  if (!fs33.existsSync(codeIntelDir)) return;
+  const codeIntelDir = path35.join(repoPath, ".code-intel");
+  if (!fs34.existsSync(codeIntelDir)) return;
   const trashName = trashDirName();
-  const trashDir = path33.join(repoPath, trashName);
+  const trashDir = path35.join(repoPath, trashName);
   let dest = trashDir;
   let counter = 1;
-  while (fs33.existsSync(dest)) {
+  while (fs34.existsSync(dest)) {
     dest = `${trashDir}-${counter++}`;
   }
-  fs33.renameSync(codeIntelDir, dest);
-  fs33.writeFileSync(
-    path33.join(dest, "TRASH_META.json"),
+  fs34.renameSync(codeIntelDir, dest);
+  fs34.writeFileSync(
+    path35.join(dest, "TRASH_META.json"),
     JSON.stringify({ deletedAt: (/* @__PURE__ */ new Date()).toISOString(), repoPath, permanent: false }, null, 2)
   );
   console.log(`  \u2713  Moved to trash: ${dest}`);
@@ -13264,15 +14021,15 @@ function softDeleteCodeIntel(repoPath) {
 function purgeStaleTrashes(repoPath) {
   const cutoff = Date.now() - TRASH_TTL_DAYS * 24 * 60 * 60 * 1e3;
   try {
-    for (const entry of fs33.readdirSync(repoPath)) {
+    for (const entry of fs34.readdirSync(repoPath)) {
       if (!entry.startsWith(".code-intel-trash-")) continue;
-      const fullPath = path33.join(repoPath, entry);
-      const metaPath = path33.join(fullPath, "TRASH_META.json");
-      if (fs33.existsSync(metaPath)) {
+      const fullPath = path35.join(repoPath, entry);
+      const metaPath = path35.join(fullPath, "TRASH_META.json");
+      if (fs34.existsSync(metaPath)) {
         try {
-          const meta = JSON.parse(fs33.readFileSync(metaPath, "utf-8"));
+          const meta = JSON.parse(fs34.readFileSync(metaPath, "utf-8"));
           if (new Date(meta.deletedAt).getTime() < cutoff) {
-            fs33.rmSync(fullPath, { recursive: true, force: true });
+            fs34.rmSync(fullPath, { recursive: true, force: true });
             console.log(`  \u2713  Auto-purged stale trash: ${fullPath}`);
           }
         } catch {
@@ -13299,18 +14056,18 @@ program.command("clean").description("Soft-delete the knowledge graph index for
   if (opts.listTrash) {
     const repos = loadRegistry();
     const roots = repos.map((r) => r.path);
-    if (roots.length === 0) roots.push(path33.resolve("."));
+    if (roots.length === 0) roots.push(path35.resolve("."));
     let found = 0;
     for (const root of roots) {
       try {
-        for (const entry of fs33.readdirSync(root)) {
+        for (const entry of fs34.readdirSync(root)) {
           if (!entry.startsWith(".code-intel-trash-")) continue;
-          const fullPath = path33.join(root, entry);
-          const metaPath = path33.join(fullPath, "TRASH_META.json");
+          const fullPath = path35.join(root, entry);
+          const metaPath = path35.join(fullPath, "TRASH_META.json");
           let deletedAt = "unknown";
-          if (fs33.existsSync(metaPath)) {
+          if (fs34.existsSync(metaPath)) {
             try {
-              deletedAt = JSON.parse(fs33.readFileSync(metaPath, "utf-8")).deletedAt;
+              deletedAt = JSON.parse(fs34.readFileSync(metaPath, "utf-8")).deletedAt;
             } catch {
             }
           }
@@ -13338,9 +14095,9 @@ program.command("clean").description("Soft-delete the knowledge graph index for
     }
     for (const r of repos) {
       if (opts.purge) {
-        const codeIntelDir = path33.join(r.path, ".code-intel");
-        if (fs33.existsSync(codeIntelDir)) {
-          fs33.rmSync(codeIntelDir, { recursive: true, force: true });
+        const codeIntelDir = path35.join(r.path, ".code-intel");
+        if (fs34.existsSync(codeIntelDir)) {
+          fs34.rmSync(codeIntelDir, { recursive: true, force: true });
           console.log(`  \u2713  Hard-deleted ${codeIntelDir}`);
         }
       } else {
@@ -13354,11 +14111,11 @@ program.command("clean").description("Soft-delete the knowledge graph index for
 `);
     return;
   }
-  const workspaceRoot = path33.resolve(targetPath);
+  const workspaceRoot = path35.resolve(targetPath);
   if (opts.purge) {
-    const codeIntelDir = path33.join(workspaceRoot, ".code-intel");
-    if (fs33.existsSync(codeIntelDir)) {
-      fs33.rmSync(codeIntelDir, { recursive: true, force: true });
+    const codeIntelDir = path35.join(workspaceRoot, ".code-intel");
+    if (fs34.existsSync(codeIntelDir)) {
+      fs34.rmSync(codeIntelDir, { recursive: true, force: true });
       console.log(`
   \u2713  Hard-deleted ${codeIntelDir}`);
     }
@@ -13370,16 +14127,16 @@ program.command("clean").description("Soft-delete the knowledge graph index for
   console.log("  Index cleaned.\n");
 });
 async function loadOrAnalyzeWorkspace(targetPath) {
-  const workspaceRoot = path33.resolve(targetPath);
+  const workspaceRoot = path35.resolve(targetPath);
   const dbPath = getDbPath(workspaceRoot);
-  const existingIndex = fs33.existsSync(dbPath) && loadMetadata(workspaceRoot) !== null;
+  const existingIndex = fs34.existsSync(dbPath) && loadMetadata(workspaceRoot) !== null;
   if (existingIndex) {
     const graph = createKnowledgeGraph();
     const db = new DbManager(dbPath);
     await db.init();
     await loadGraphFromDB(graph, db);
     db.close();
-    return { graph, workspaceRoot, repoName: path33.basename(workspaceRoot) };
+    return { graph, workspaceRoot, repoName: path35.basename(workspaceRoot) };
   }
   return analyzeWorkspace(targetPath, { silent: true });
 }
@@ -13514,6 +14271,43 @@ program.command("impact").description("Show the blast radius \u2014 all symbols
   }
   console.log("");
 });
+program.command("deprecated").description("Find usages of deprecated APIs in the codebase").argument("[path]", "Path to the repository (default: current directory)", ".").option("--format <fmt>", "Output format: table or json", "table").addHelpText("after", `
+  Scans the knowledge graph for deprecated symbols (via @deprecated JSDoc,
+  @Deprecated annotations, #[deprecated] attributes, or known Node.js APIs)
+  and reports every caller.
+
+  Examples:
+    $ code-intel deprecated
+    $ code-intel deprecated ./src --format json
+`).action(async (targetPath, options) => {
+  const { graph } = await loadOrAnalyzeWorkspace(targetPath);
+  const { DeprecatedDetector: DeprecatedDetector2 } = await Promise.resolve().then(() => (init_deprecated_detector(), deprecated_detector_exports));
+  const detector = new DeprecatedDetector2();
+  detector.tagDeprecated(graph);
+  const findings = detector.detect(graph);
+  if (options.format === "json") {
+    console.log(JSON.stringify({ findings, total: findings.length }, null, 2));
+    return;
+  }
+  console.log("\n  \u25C8  Deprecated API Usage Report\n");
+  if (findings.length === 0) {
+    console.log("  No deprecated API usages found.\n");
+    return;
+  }
+  console.log(`  ${"Symbol".padEnd(30)} ${"File".padEnd(40)} Message`);
+  console.log(`  ${"-".repeat(100)}`);
+  for (const f of findings) {
+    console.log(`  ${f.symbol.padEnd(30)} ${f.filePath.padEnd(40)} ${f.deprecationMessage}`);
+    if (f.callers.length > 0) {
+      console.log(`
+  Callers:`);
+      for (const c of f.callers) {
+        console.log(`    ${c.name.padEnd(30)} ${c.filePath}`);
+      }
+      console.log("");
+    }
+  }
+});
 var groupCmd = program.command("group").description("Manage repository groups for multi-repo / monorepo service tracking").addHelpText("after", `
   Repository groups let you track contracts (exports, routes, schemas, events)
   across multiple indexed repos and detect cross-repo dependencies automatically.
@@ -13807,9 +14601,9 @@ groupCmd.command("status <name>").description("Check index freshness and sync st
       console.log(`  \u2717  ${m.groupPath.padEnd(35)} [${m.registryName}]  \u2014 NOT IN REGISTRY`);
       continue;
     }
-    const metaPath = path33.join(regEntry.path, ".code-intel", "meta.json");
+    const metaPath = path35.join(regEntry.path, ".code-intel", "meta.json");
     try {
-      const meta = JSON.parse(fs33.readFileSync(metaPath, "utf-8"));
+      const meta = JSON.parse(fs34.readFileSync(metaPath, "utf-8"));
       const indexedAt = meta.indexedAt;
       const ageMin = Math.round((now - new Date(indexedAt).getTime()) / 6e4);
       const stale = ageMin > 1440 ? "  \u26A0  STALE (>24h)" : "";
@@ -13826,7 +14620,7 @@ groupCmd.command("status <name>").description("Check index freshness and sync st
   }
 });
 groupCmd.command("init-workspace [path]").description("Auto-discover workspace packages and create a group").option("--name <name>", "Group name (default: workspace root dirname)").option("--no-analyze", "Register packages without running analysis").option("--yes", "Skip confirmation prompt").option("--parallel <n>", "Concurrent analyses (default: 2)", "2").action(async (targetPath, opts) => {
-  const root = path33.resolve(targetPath ?? ".");
+  const root = path35.resolve(targetPath ?? ".");
   const ws = await detectWorkspace(root);
   if (!ws) {
     console.error(`
@@ -13835,7 +14629,7 @@ groupCmd.command("init-workspace [path]").description("Auto-discover workspace p
 `);
     process.exit(1);
   }
-  const groupName = opts.name ?? path33.basename(root);
+  const groupName = opts.name ?? path35.basename(root);
   console.log(`
   \u25C8  Workspace detected: ${ws.type}`);
   console.log(`     Group name    : ${groupName}`);
@@ -14114,7 +14908,7 @@ backupCmd.command("create [path]").description("Create an encrypted backup of th
     $ code-intel backup create
     $ code-intel backup create ./my-project
 `).action((targetPath = ".") => {
-  const repoPath = path33.resolve(targetPath);
+  const repoPath = path35.resolve(targetPath);
   const svc = new BackupService();
   try {
     const entry = svc.createBackup(repoPath);
@@ -14143,7 +14937,7 @@ backupCmd.command("list").description("List all available backups").action(() =>
   Backups (${entries.length}):
 `);
   for (const e of entries) {
-    const exists = fs33.existsSync(e.path);
+    const exists = fs34.existsSync(e.path);
     const status = exists ? "\u2713" : "\u2717 (missing)";
     console.log(`  ${status}  ${e.id.slice(0, 8)}  ${e.createdAt}  ${(e.size / 1024).toFixed(1)} KB  \u2192  ${e.repoPath}`);
   }
@@ -14156,7 +14950,7 @@ backupCmd.command("restore <id>").description("Restore a backup by ID").option("
 `).action((id, opts) => {
   const svc = new BackupService();
   try {
-    const targetPath = opts.target ? path33.resolve(opts.target) : void 0;
+    const targetPath = opts.target ? path35.resolve(opts.target) : void 0;
     svc.restoreBackup(id, targetPath);
     console.log(`
   \u2705  Backup "${id}" restored successfully.
@@ -14175,8 +14969,8 @@ program.command("migrate").description("Manage database schema migrations").opti
     $ code-intel migrate
     $ code-intel migrate --rollback
 `).action((opts) => {
-  const dbPath = opts.db ?? path33.join(os12.homedir(), ".code-intel", "users.db");
-  if (!fs33.existsSync(dbPath)) {
+  const dbPath = opts.db ?? path35.join(os12.homedir(), ".code-intel", "users.db");
+  if (!fs34.existsSync(dbPath)) {
     console.error(`
   \u2717  Database not found: ${dbPath}
   Run \`code-intel serve\` or \`code-intel user create\` first.
@@ -14291,15 +15085,15 @@ authCmd.command("login").description("Authenticate via OIDC device flow \u2014 o
   }
   try {
     const tokens = await pollDeviceFlow3(config, deviceResponse);
-    const tokenPath = path33.join(os12.homedir(), ".code-intel", "oidc-token.json");
+    const tokenPath = path35.join(os12.homedir(), ".code-intel", "oidc-token.json");
     const tokenData = {
       accessToken: tokens.accessToken,
       refreshToken: tokens.refreshToken,
       server: serverUrl,
       storedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    fs33.mkdirSync(path33.dirname(tokenPath), { recursive: true });
-    fs33.writeFileSync(tokenPath, JSON.stringify(tokenData, null, 2), { mode: 384 });
+    fs34.mkdirSync(path35.dirname(tokenPath), { recursive: true });
+    fs34.writeFileSync(tokenPath, JSON.stringify(tokenData, null, 2), { mode: 384 });
     console.log(`  \u2705  Authenticated successfully!`);
     console.log(`  Token stored at: ${tokenPath}`);
     console.log(`  Use CODE_INTEL_TOKEN env var or --token flag to use it with CLI/MCP.
@@ -14312,13 +15106,13 @@ authCmd.command("login").description("Authenticate via OIDC device flow \u2014 o
   }
 });
 authCmd.command("status").description("Show the current OIDC authentication status").action(() => {
-  const tokenPath = path33.join(os12.homedir(), ".code-intel", "oidc-token.json");
-  if (!fs33.existsSync(tokenPath)) {
+  const tokenPath = path35.join(os12.homedir(), ".code-intel", "oidc-token.json");
+  if (!fs34.existsSync(tokenPath)) {
     console.log("\n  Not authenticated via OIDC. Run: code-intel auth login\n");
     return;
   }
   try {
-    const data = JSON.parse(fs33.readFileSync(tokenPath, "utf-8"));
+    const data = JSON.parse(fs34.readFileSync(tokenPath, "utf-8"));
     console.log(`
   \u2705  OIDC token stored`);
     console.log(`  Server : ${data.server ?? "unknown"}`);
@@ -14330,9 +15124,9 @@ authCmd.command("status").description("Show the current OIDC authentication stat
   }
 });
 authCmd.command("logout").description("Remove locally stored OIDC token").action(() => {
-  const tokenPath = path33.join(os12.homedir(), ".code-intel", "oidc-token.json");
-  if (fs33.existsSync(tokenPath)) {
-    fs33.unlinkSync(tokenPath);
+  const tokenPath = path35.join(os12.homedir(), ".code-intel", "oidc-token.json");
+  if (fs34.existsSync(tokenPath)) {
+    fs34.unlinkSync(tokenPath);
     console.log("\n  \u2705  OIDC token removed. You are now logged out.\n");
   } else {
     console.log("\n  No stored token found.\n");
@@ -14377,7 +15171,7 @@ authCmd.command("rotate-token <id>").description("Rotate an API token \u2014 iss
   console.log("\n  Save the new token now \u2014 it will NOT be shown again!\n");
   console.log("  Usage: Authorization: Bearer <new-token>\n");
 });
-var secretsCmd = program.command("secrets").description("Manage the encrypted .code-intel/.secrets store (AES-256-GCM)");
+var secretsCmd = program.command("keystore").description("Manage the encrypted .code-intel/.secrets store (AES-256-GCM)");
 secretsCmd.command("set <key> <value>").description("Store a secret by key").action((key, value) => {
   try {
     setSecret(key, value);
@@ -14456,8 +15250,8 @@ program.command("config-validate <file>").description("Validate a JSON config fi
     $ code-intel config-validate ./config.json
     $ code-intel config-validate ~/.code-intel/config.json
 `).action((file) => {
-  const filePath = path33.resolve(file);
-  if (!fs33.existsSync(filePath)) {
+  const filePath = path35.resolve(file);
+  if (!fs34.existsSync(filePath)) {
     console.error(`
   \u2717  File not found: ${filePath}
 `);
@@ -14465,7 +15259,7 @@ program.command("config-validate <file>").description("Validate a JSON config fi
   }
   let cfg;
   try {
-    cfg = JSON.parse(fs33.readFileSync(filePath, "utf-8"));
+    cfg = JSON.parse(fs34.readFileSync(filePath, "utf-8"));
   } catch (err) {
     console.error(`
   \u2717  Could not parse JSON: ${err instanceof Error ? err.message : err}
@@ -14486,7 +15280,7 @@ ${err instanceof Error ? err.message : err}
 });
 (function ensurePermissions() {
   try {
-    const dir = path33.join(os12.homedir(), ".code-intel");
+    const dir = path35.join(os12.homedir(), ".code-intel");
     secureMkdir(dir);
     tightenDbFiles(dir);
   } catch {
@@ -14503,10 +15297,10 @@ program.command("health").description("Run code health checks: dead code, circul
     $ code-intel health --json
     $ code-intel health --threshold 80
 `).action(async (targetPath, opts) => {
-  const workspaceRoot = path33.resolve(targetPath);
+  const workspaceRoot = path35.resolve(targetPath);
   const dbPath = getDbPath(workspaceRoot);
   const meta = loadMetadata(workspaceRoot);
-  if (!meta || !fs33.existsSync(dbPath)) {
+  if (!meta || !fs34.existsSync(dbPath)) {
     console.error(`
   \u2717  ${workspaceRoot} is not indexed.`);
     console.error("     Run `code-intel analyze` first to build the index.\n");
@@ -14591,7 +15385,7 @@ program.command("query").description("Execute a GQL (Graph Query Language) query
     $ code-intel query --list
     $ code-intel query --delete auth-search
 `).action(async (gqlArg, opts) => {
-  const workspaceRoot = path33.resolve(opts.path);
+  const workspaceRoot = path35.resolve(opts.path);
   const { saveQuery: saveQuery2, loadQuery: loadQuery2, listQueries: listQueries2, deleteQuery: deleteQuery2 } = await Promise.resolve().then(() => (init_saved_queries(), saved_queries_exports));
   if (opts.list) {
     const queries = listQueries2(workspaceRoot);
@@ -14650,14 +15444,14 @@ program.command("query").description("Execute a GQL (Graph Query Language) query
     }
     gqlInput = content;
   } else if (opts.file) {
-    const filePath = path33.resolve(opts.file);
-    if (!fs33.existsSync(filePath)) {
+    const filePath = path35.resolve(opts.file);
+    if (!fs34.existsSync(filePath)) {
       console.error(`
   \u2717  File not found: ${filePath}
 `);
       process.exit(1);
     }
-    gqlInput = fs33.readFileSync(filePath, "utf-8");
+    gqlInput = fs34.readFileSync(filePath, "utf-8");
   } else if (gqlArg) {
     gqlInput = gqlArg;
   } else {
@@ -14780,7 +15574,7 @@ program.command("pr-impact").description("Compute PR blast radius and risk score
     $ code-intel pr-impact --base main --head HEAD --format sarif
     $ code-intel pr-impact --base main --head HEAD --format json
 `).action(async (opts) => {
-  const repoPath = path33.resolve(opts.path ?? ".");
+  const repoPath = path35.resolve(opts.path ?? ".");
   const { execSync: execSync3 } = await import('child_process');
   let diff;
   try {
@@ -14866,6 +15660,242 @@ program.command("pr-impact").description("Compute PR blast radius and risk score
     process.exit(1);
   }
 });
+program.command("complexity").description("Show complexity hotspots ranked by cyclomatic complexity").argument("[path]", "Path to the repository (default: current directory)", ".").option("--top <n>", "Show top N results (default: 20)", "20").option("--threshold <n>", "Only show results above this cyclomatic threshold").option("--format <fmt>", "Output format: table or json (default: table)", "table").option("--scope <scope>", "Limit to a file path prefix").addHelpText("after", `
+  Loads the knowledge graph and ranks functions/methods by cyclomatic complexity.
+
+  Examples:
+    $ code-intel complexity
+    $ code-intel complexity --top 10
+    $ code-intel complexity --threshold 10
+    $ code-intel complexity --format json
+`).action(async (targetPath, opts) => {
+  const { graph } = await loadOrAnalyzeWorkspace(targetPath);
+  const { computeComplexity: computeComplexity2 } = await Promise.resolve().then(() => (init_complexity(), complexity_exports));
+  let results = computeComplexity2(graph, opts.scope);
+  if (opts.threshold !== void 0) {
+    const thresh = parseInt(opts.threshold, 10);
+    if (!isNaN(thresh)) results = results.filter((r) => r.cyclomatic > thresh);
+  }
+  const top = parseInt(opts.top, 10);
+  if (!isNaN(top) && top > 0) results = results.slice(0, top);
+  if (opts.format === "json") {
+    console.log(JSON.stringify(results, null, 2));
+    return;
+  }
+  if (results.length === 0) {
+    console.log("\n  No complexity results found.\n");
+    return;
+  }
+  console.log("\n  \u25C8  Complexity Hotspots\n");
+  const header = `  ${"Rank".padEnd(5)} ${"Symbol".padEnd(28)} ${"File".padEnd(40)} ${"Cyclo".padEnd(7)} ${"Cogn".padEnd(7)} Severity`;
+  console.log(header);
+  console.log("  " + "\u2500".repeat(header.length - 2));
+  for (let i = 0; i < results.length; i++) {
+    const r = results[i];
+    const rank = String(i + 1).padEnd(5);
+    const name = r.name.slice(0, 27).padEnd(28);
+    const file = r.filePath.slice(0, 39).padEnd(40);
+    const cyc = String(r.cyclomatic).padEnd(7);
+    const cog = String(r.cognitive).padEnd(7);
+    console.log(`  ${rank} ${name} ${file} ${cyc} ${cog} ${r.severity}`);
+  }
+  console.log("");
+});
+program.command("coverage").description("Show untested exported symbols ranked by blast radius").argument("[path]", "Path to the repository (default: current directory)", ".").option("--threshold <pct>", "Exit code 1 when coverage is below this percentage").option("--format <fmt>", "Output format: table or json (default: table)", "table").option("--scope <scope>", "Limit to a file path prefix").addHelpText("after", `
+  Loads the knowledge graph and identifies exported symbols with no test coverage.
+
+  Examples:
+    $ code-intel coverage
+    $ code-intel coverage --threshold 80
+    $ code-intel coverage --format json
+`).action(async (targetPath, opts) => {
+  const { graph } = await loadOrAnalyzeWorkspace(targetPath);
+  const { computeCoverage: computeCoverage2 } = await Promise.resolve().then(() => (init_test_coverage(), test_coverage_exports));
+  const summary = computeCoverage2(graph, opts.scope);
+  if (opts.format === "json") {
+    console.log(JSON.stringify(summary, null, 2));
+  } else {
+    console.log("\n  \u25C8  Test Coverage Gaps\n");
+    console.log(`  Coverage: ${summary.testedExported}/${summary.totalExported} exported symbols tested (${summary.coveragePct}%)
+`);
+    if (summary.untestedByRisk.length === 0) {
+      console.log("  All exported symbols have test coverage.\n");
+    } else {
+      console.log("  Untested exported symbols (by blast radius):\n");
+      const header = `  ${"Symbol".padEnd(28)} ${"File".padEnd(40)} ${"Blast".padEnd(7)} Risk`;
+      console.log(header);
+      console.log("  " + "\u2500".repeat(header.length - 2));
+      for (const r of summary.untestedByRisk) {
+        const name = r.name.slice(0, 27).padEnd(28);
+        const file = r.filePath.slice(0, 39).padEnd(40);
+        const blast = String(r.blastRadius).padEnd(7);
+        console.log(`  ${name} ${file} ${blast} ${r.risk}`);
+      }
+      console.log("");
+    }
+  }
+  if (opts.threshold !== void 0) {
+    const thresh = parseInt(opts.threshold, 10);
+    if (!isNaN(thresh) && summary.coveragePct < thresh) {
+      process.exit(1);
+    }
+  }
+});
+program.command("secrets").description("Scan for hardcoded secrets in the knowledge graph").argument("[path]", "Path to the repository (default: current directory)", ".").option("--format <fmt>", "Output format: table|json (default: table)", "table").option("--fail-on", "Exit 1 if any findings are found").option("--fix-hint", "Show hint to use process.env.VARIABLE_NAME instead").option("--include-tests", "Include test/spec/fixture files in scan").addHelpText("after", `
+  Scans the indexed knowledge graph for hardcoded secrets (API keys, passwords,
+  tokens, private keys, high-entropy strings).
+
+  Examples:
+    $ code-intel secrets
+    $ code-intel secrets --format json
+    $ code-intel secrets --fail-on
+    $ code-intel secrets --fix-hint
+`).action(async (targetPath, opts) => {
+  const { graph } = await loadOrAnalyzeWorkspace(targetPath);
+  const { SecretScanner: SecretScanner2 } = await Promise.resolve().then(() => (init_secret_scanner(), secret_scanner_exports));
+  const scanner = new SecretScanner2();
+  const findings = scanner.scan(graph, { includeTestFiles: opts.includeTests });
+  if ((opts.format ?? "table") === "json") {
+    console.log(JSON.stringify({ findings, total: findings.length }, null, 2));
+  } else {
+    if (findings.length === 0) {
+      console.log("\n  \u2705  No hardcoded secrets found.\n");
+    } else {
+      console.log(`
+  \u26A0\uFE0F  Found ${findings.length} potential secret(s):
+`);
+      console.log(`  ${"FILE".padEnd(50)} ${"LINE".padEnd(6)} ${"SYMBOL".padEnd(30)} PATTERN`);
+      console.log(`  ${"\u2500".repeat(100)}`);
+      for (const f of findings) {
+        const line = f.line !== void 0 ? String(f.line) : "?";
+        console.log(`  ${f.file.padEnd(50)} ${line.padEnd(6)} ${f.symbol.padEnd(30)} ${f.pattern}`);
+        if (opts.fixHint) {
+          console.log(`    \u{1F4A1}  Hint: Use process.env.${f.symbol.toUpperCase()} instead of a hardcoded value`);
+        }
+      }
+      console.log("");
+    }
+  }
+  if (opts.failOn && findings.length > 0) {
+    process.exit(1);
+  }
+});
+program.command("scan").description("Run security scans: secrets + OWASP vulnerability detection").argument("[path]", "Path to the repository (default: current directory)", ".").option("--type <types>", "Comma-separated detector types: secrets,sql,xss,ssrf,path,cmd").option("--severity <level>", "Minimum severity to report: high|medium|low (default: low)", "low").option("--format <fmt>", "Output format: table|json|sarif (default: table)", "table").option("--fail-on <level>", "Exit 1 if findings at or above this severity: high|medium").option("--exclude <pattern>", "Exclude files matching this pattern").addHelpText("after", `
+  Runs both secret detection and OWASP vulnerability scanning against the
+  indexed knowledge graph.
+
+  Examples:
+    $ code-intel scan
+    $ code-intel scan --type secrets,sql
+    $ code-intel scan --severity high --format json
+    $ code-intel scan --fail-on high
+`).action(async (targetPath, opts) => {
+  const { graph } = await loadOrAnalyzeWorkspace(targetPath);
+  const { SecretScanner: SecretScanner2 } = await Promise.resolve().then(() => (init_secret_scanner(), secret_scanner_exports));
+  const { VulnerabilityDetector: VulnerabilityDetector2 } = await Promise.resolve().then(() => (init_vulnerability_detector(), vulnerability_detector_exports));
+  const requestedTypes = opts.type ? opts.type.split(",").map((t) => t.trim().toLowerCase()) : null;
+  const minSeverity = (opts.severity ?? "low").toLowerCase();
+  const severityRank = { high: 3, medium: 2, low: 1 };
+  const minRank = severityRank[minSeverity] ?? 1;
+  const allFindings = [];
+  if (!requestedTypes || requestedTypes.includes("secrets")) {
+    const scanner = new SecretScanner2();
+    const secrets = scanner.scan(graph);
+    for (const s of secrets) {
+      allFindings.push({
+        kind: "secret",
+        severity: s.severity,
+        file: s.file,
+        line: s.line,
+        symbol: s.symbol,
+        type: `SECRET:${s.pattern}`,
+        description: `Hardcoded secret pattern: ${s.pattern}`
+      });
+    }
+  }
+  const typeMap = {
+    sql: "SQL_INJECTION",
+    xss: "XSS",
+    ssrf: "SSRF",
+    path: "PATH_TRAVERSAL",
+    cmd: "COMMAND_INJECTION"
+  };
+  const vulnTypes = requestedTypes ? requestedTypes.filter((t) => t in typeMap).map((t) => typeMap[t]) : ["SQL_INJECTION", "XSS", "SSRF", "PATH_TRAVERSAL", "COMMAND_INJECTION"];
+  if (vulnTypes.length > 0 && (!requestedTypes || requestedTypes.some((t) => t in typeMap))) {
+    const detector = new VulnerabilityDetector2();
+    const vulns = detector.detect(graph, { types: vulnTypes });
+    for (const v of vulns) {
+      allFindings.push({
+        kind: "vulnerability",
+        severity: v.severity,
+        file: v.file,
+        line: v.line,
+        symbol: v.symbol,
+        type: v.type,
+        description: v.description,
+        cweId: v.cweId
+      });
+    }
+  }
+  const exclude = opts.exclude;
+  const filtered = allFindings.filter((f) => {
+    if (exclude && f.file.includes(exclude)) return false;
+    const rank = severityRank[f.severity.toLowerCase()] ?? 1;
+    return rank >= minRank;
+  });
+  const format = (opts.format ?? "table").toLowerCase();
+  if (format === "json") {
+    console.log(JSON.stringify({ findings: filtered, total: filtered.length }, null, 2));
+  } else if (format === "sarif") {
+    const sarif = {
+      version: "2.1.0",
+      $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+      runs: [{
+        tool: { driver: { name: "code-intel", version: "0.8.0", rules: [] } },
+        results: filtered.map((f) => ({
+          ruleId: f.type,
+          message: { text: f.description },
+          locations: [{
+            physicalLocation: {
+              artifactLocation: { uri: f.file },
+              region: { startLine: f.line ?? 1 }
+            }
+          }],
+          level: f.severity === "HIGH" ? "error" : f.severity === "MEDIUM" ? "warning" : "note"
+        }))
+      }]
+    };
+    console.log(JSON.stringify(sarif, null, 2));
+  } else {
+    if (filtered.length === 0) {
+      console.log("\n  \u2705  No security findings.\n");
+    } else {
+      const highCount = filtered.filter((f) => f.severity === "HIGH").length;
+      const medCount = filtered.filter((f) => f.severity === "MEDIUM").length;
+      const lowCount = filtered.filter((f) => f.severity === "LOW").length;
+      console.log(`
+  \u25C8  Security Scan \u2014 ${path35.resolve(targetPath)}
+`);
+      console.log(`  HIGH: ${highCount}  MEDIUM: ${medCount}  LOW: ${lowCount}
+`);
+      for (const f of filtered) {
+        const icon = f.severity === "HIGH" ? "\u{1F534}" : f.severity === "MEDIUM" ? "\u{1F7E1}" : "\u{1F7E2}";
+        const cwe = f.cweId ? `  [${f.cweId}]` : "";
+        console.log(`  ${icon}  ${f.severity.padEnd(8)} ${f.type}${cwe}`);
+        const line = f.line !== void 0 ? `:${f.line}` : "";
+        console.log(`       ${f.file}${line}  ${f.symbol}`);
+        console.log(`       ${f.description}`);
+        console.log("");
+      }
+    }
+  }
+  const failOnLevel = (opts.failOn ?? "").toLowerCase();
+  if (failOnLevel === "high" && filtered.some((f) => f.severity === "HIGH")) {
+    process.exit(1);
+  } else if (failOnLevel === "medium" && filtered.some((f) => f.severity === "HIGH" || f.severity === "MEDIUM")) {
+    process.exit(1);
+  }
+});
 program.parse();
 //# sourceMappingURL=main.js.map
 //# sourceMappingURL=main.js.map